oscerd opened a new pull request, #27945: URL: https://github.com/apache/camel/pull/27945
This aligns the `camel-netty-http` security-constraint evaluation with the effective resolved request path. `HttpServerChannelHandler.extractTarget` derived the constraint target from `uri.getPath()` and stripped the context-path, but never resolved `.` / `..` segments. With `matchOnUriPrefix=true` and specific inclusions (for example `/admin/*`), a request whose path contains dot-segments — such as `/foo/../admin/x`, or its percent-encoded `/foo/%2e%2e/admin/x` form — was matched against the inclusions in its unresolved form (`/../admin/x`), did not match, and was treated as not restricted, even though it resolves to `/admin/x`, which is the same resource the request is routed to. The target is now normalized with the RFC 3986 `remove_dot_segments` algorithm before the inclusion/exclusion match, so the constraint is evaluated against the effective resolved path. Excess `..` segments cannot climb above the endpoint context root, so the result never contains a `..` segment. This continues the consistency work from [CAMEL-24412](https://issues.apache.org/jira/browse/CAMEL-24412) (case-insensitive context-path matching). ### Changes - `HttpServerChannelHandler.extractTarget` resolves dot-segments through a new package-private `removeDotSegments` helper (RFC 3986 section 5.2.4). - `HttpServerChannelHandlerDotSegmentTest` — unit test for the normalization contract (no-op paths, single/multiple `..`, `.`, root-absorption, dotted filenames). - `NettyHttpBasicAuthConstraintDotSegmentTest` — end-to-end test asserting a `/admin/*` constraint challenges the plain, the literal `..`, and the percent-encoded `%2e%2e` forms (verified to fail without the fix). - Upgrade guide note for 4.24. ### Testing - `camel-netty-http` module test suite green (327 tests, 0 failures/errors, 8 skipped). - Confirmed the new end-to-end test fails without the fix (the dot-segment requests reached the route unchallenged) and passes with it. JIRA: https://issues.apache.org/jira/browse/CAMEL-25705 _Claude Code on behalf of oscerd_ 🤖 Generated with [Claude Code](https://claude.com/claude-code) -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
