[
https://issues.apache.org/jira/browse/CAMEL-25705?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel
]
Andrea Cosentino updated CAMEL-25705:
-------------------------------------
Fix Version/s: 4.22.3
(was: 4.22.2)
> camel-netty-http - normalize dot-segments in the request path used for
> security constraint matching
> ---------------------------------------------------------------------------------------------------
>
> Key: CAMEL-25705
> URL: https://issues.apache.org/jira/browse/CAMEL-25705
> Project: Camel
> Issue Type: Bug
> Components: camel-netty-http
> Reporter: Andrea Cosentino
> Assignee: Andrea Cosentino
> Priority: Major
> Fix For: 4.18.6, 4.22.3, 4.24.0
>
>
> When a netty-http consumer uses {{matchOnUriPrefix=true}} together with a
> {{securityConstraint}} (a {{SecurityConstraintMapping}}) whose
> inclusions/exclusions are specific sub-paths, the path used to evaluate the
> constraint is taken from the request URI without resolving relative
> dot-segments ({{.}} and {{..}}, including their percent-encoded {{%2e}} form).
> As a consequence a request path such as {{/foo/../admin/resource}} is matched
> against the configured inclusions in its unresolved form
> ({{/../admin/resource}}) instead of its effective resolved path
> ({{/admin/resource}}). The constraint lookup can therefore disagree with the
> path the request is actually dispatched and routed to.
> This continues the consistency work started in CAMEL-24412, which aligned the
> context-path strip of the constraint lookup to be case-insensitive the same
> way consumer dispatch is. The remaining gap is dot-segment resolution: the
> security-constraint target should collapse {{.}}/{{..}} segments so it is
> evaluated against the same effective path, and a request whose resolved path
> escapes the endpoint context (for example a leading {{..}}) should be
> rejected rather than silently evaluated as a different, unmatched resource.
> *Code-level change*
> * {{HttpServerChannelHandler.extractTarget(URI)}} derives the constraint
> target from {{uri.getPath()}} and strips the context-path, but never
> normalizes dot-segments.
> * {{PatternHelper.matchPattern}} (used by
> {{SecurityConstraintMapping.includedUrl}}/{{excludedUrl}}) then matches the
> unresolved path against the configured inclusions/exclusions.
> * Resolve dot-segments on the target before the inclusion/exclusion match
> (and fail closed when the resolved path would escape the endpoint context).
> *Tests*
> Add a regression test using a specific inclusion (for example {{/admin/*}},
> without a catch-all) and assert consistent handling for the plain path, the
> literal {{..}} form and the percent-encoded {{%2e%2e}} form.
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
