[
https://issues.apache.org/jira/browse/SLING-13382?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel
]
Joerg Hoh updated SLING-13382:
------------------------------
Description:
h2. Problem
{{DeepReadValueMapDecorator}} resolves the resource portion of a deep-read key
without checking whether the target remains within the starting resource's
subtree.
For example, given a resource at {{/content/site/page}}:
{code:java}
valueMap.get("../otherpage/jcr:content/title", String.class);
{code}
The decorator resolves {{/content/site/page/../otherpage/jcr:content}}, which
points to {{/content/site/otherpage/jcr:content}}, outside the starting subtree.
This behavior affects {{get(Object)}}, {{get(String, Class)}}, {{get(String,
Object)}} and {{containsKey(Object)}}.
h2. Potential impact
If a consumer accepts externally controlled deep-read keys and uses a
privileged service resolver, it may expose properties outside the intended
subtree.
Reads remain subject to the backing resolver's permissions; this is not a
resolver ACL bypass. Consumers using fixed keys or appropriately restricted
resolvers may not be affected.
h2. Implementation
As this can cause b/w compatitbility issues, the implementation should WARN by
default when this issue is encountered, but not block. There should be an
enforcing mode to convert this into an IllegalArgumentException.
h2. Compatibility considerations
{{ResourceResolver.getResource()}} explicitly supports resolving {{.}} and
{{..}} segments. The {{ValueMap}} documentation describes deep reads as
equivalent to child-resource lookup but does not explicitly guarantee subtree
containment.
Restricting parent traversal therefore requires assessing existing consumers
and intended API behavior. {{AbstractResource.getValueMap()}} uses this
decorator only when direct adaptation to {{ValueMap}} fails.
was:
h2. Problem
{{DeepReadValueMapDecorator}} resolves the resource portion of a deep-read key
without checking whether the target remains within the starting resource's
subtree.
For example, given a resource at {{/content/site/page}}:
{code:java}
valueMap.get("../otherpage/jcr:content/title", String.class);
{code}
The decorator resolves {{/content/site/page/../otherpage/jcr:content}}, which
points to {{/content/site/otherpage/jcr:content}}, outside the starting subtree.
This behavior affects {{get(Object)}}, {{get(String, Class)}}, {{get(String,
Object)}} and {{containsKey(Object)}}.
h2. Potential impact
If a consumer accepts externally controlled deep-read keys and uses a
privileged service resolver, it may expose properties outside the intended
subtree.
Reads remain subject to the backing resolver's permissions; this is not a
resolver ACL bypass. Consumers using fixed keys or appropriately restricted
resolvers may not be affected.
h2. Compatibility considerations
{{ResourceResolver.getResource()}} explicitly supports resolving {{.}} and
{{..}} segments. The {{ValueMap}} documentation describes deep reads as
equivalent to child-resource lookup but does not explicitly guarantee subtree
containment.
Restricting parent traversal therefore requires assessing existing consumers
and intended API behavior. {{AbstractResource.getValueMap()}} uses this
decorator only when direct adaptation to {{ValueMap}} fails.
> Warn on parent traversal in DeepReadValueMapDecorator
> -----------------------------------------------------
>
> Key: SLING-13382
> URL: https://issues.apache.org/jira/browse/SLING-13382
> Project: Sling
> Issue Type: Task
> Components: API
> Reporter: Joerg Hoh
> Priority: Major
>
> h2. Problem
> {{DeepReadValueMapDecorator}} resolves the resource portion of a deep-read
> key without checking whether the target remains within the starting
> resource's subtree.
> For example, given a resource at {{/content/site/page}}:
> {code:java}
> valueMap.get("../otherpage/jcr:content/title", String.class);
> {code}
> The decorator resolves {{/content/site/page/../otherpage/jcr:content}}, which
> points to {{/content/site/otherpage/jcr:content}}, outside the starting
> subtree.
> This behavior affects {{get(Object)}}, {{get(String, Class)}}, {{get(String,
> Object)}} and {{containsKey(Object)}}.
> h2. Potential impact
> If a consumer accepts externally controlled deep-read keys and uses a
> privileged service resolver, it may expose properties outside the intended
> subtree.
> Reads remain subject to the backing resolver's permissions; this is not a
> resolver ACL bypass. Consumers using fixed keys or appropriately restricted
> resolvers may not be affected.
> h2. Implementation
> As this can cause b/w compatitbility issues, the implementation should WARN
> by default when this issue is encountered, but not block. There should be an
> enforcing mode to convert this into an IllegalArgumentException.
> h2. Compatibility considerations
> {{ResourceResolver.getResource()}} explicitly supports resolving {{.}} and
> {{..}} segments. The {{ValueMap}} documentation describes deep reads as
> equivalent to child-resource lookup but does not explicitly guarantee subtree
> containment.
> Restricting parent traversal therefore requires assessing existing consumers
> and intended API behavior. {{AbstractResource.getValueMap()}} uses this
> decorator only when direct adaptation to {{ValueMap}} fails.
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
