This is an automated email from the ASF dual-hosted git repository.
janhoy pushed a commit to branch main
in repository https://gitbox.apache.org/repos/asf/solr.git
The following commit(s) were added to refs/heads/main by this push:
new d9e1468dda4 PKIAuthenticationPlugin: handle non-base64 SolrAuthV2
signature (#4553)
d9e1468dda4 is described below
commit d9e1468dda4d00f20e211e51a69c095bc3be5457
Author: Jan Høydahl <[email protected]>
AuthorDate: Wed Aug 5 11:43:13 2026 +0200
PKIAuthenticationPlugin: handle non-base64 SolrAuthV2 signature (#4553)
---
.../unreleased/PR#4553-pki-v2-header-base64-fix.yml | 7 +++++++
.../apache/solr/security/PKIAuthenticationPlugin.java | 8 +++++++-
.../solr/security/TestPKIAuthenticationPlugin.java | 17 +++++++++++++++++
3 files changed, 31 insertions(+), 1 deletion(-)
diff --git a/changelog/unreleased/PR#4553-pki-v2-header-base64-fix.yml
b/changelog/unreleased/PR#4553-pki-v2-header-base64-fix.yml
new file mode 100644
index 00000000000..9e503d01e70
--- /dev/null
+++ b/changelog/unreleased/PR#4553-pki-v2-header-base64-fix.yml
@@ -0,0 +1,7 @@
+title: PKIAuthenticationPlugin now rejects a SolrAuthV2 header with a
malformed signature using a 401 response, instead of returning a 500
+type: fixed
+authors:
+ - name: Jan Høydahl
+links:
+ - name: PR#4553
+ url: https://github.com/apache/solr/pull/4553
diff --git
a/solr/core/src/java/org/apache/solr/security/PKIAuthenticationPlugin.java
b/solr/core/src/java/org/apache/solr/security/PKIAuthenticationPlugin.java
index 7c2eb80c28b..aef49c122ff 100644
--- a/solr/core/src/java/org/apache/solr/security/PKIAuthenticationPlugin.java
+++ b/solr/core/src/java/org/apache/solr/security/PKIAuthenticationPlugin.java
@@ -209,7 +209,13 @@ public class PKIAuthenticationPlugin extends
AuthenticationPlugin
int sigStart = header.lastIndexOf(' ');
String data = header.substring(0, sigStart);
- byte[] sig = Base64.getDecoder().decode(header.substring(sigStart + 1));
+ byte[] sig;
+ try {
+ sig = Base64.getDecoder().decode(header.substring(sigStart + 1));
+ } catch (IllegalArgumentException e) {
+ log.warn("Could not parse signature in SolrAuthV2 header as base64");
+ return null;
+ }
PKIHeaderData rv = validateSignature(data, sig, key, false);
if (rv == null) {
log.warn("Failed to verify signature, trying after refreshing the key ");
diff --git
a/solr/core/src/test/org/apache/solr/security/TestPKIAuthenticationPlugin.java
b/solr/core/src/test/org/apache/solr/security/TestPKIAuthenticationPlugin.java
index cff82ba6e7a..b19750cb564 100644
---
a/solr/core/src/test/org/apache/solr/security/TestPKIAuthenticationPlugin.java
+++
b/solr/core/src/test/org/apache/solr/security/TestPKIAuthenticationPlugin.java
@@ -207,6 +207,23 @@ public class TestPKIAuthenticationPlugin extends
SolrTestCaseJ4 {
"Should not have proceeded after authentication failure",
wrappedRequestByFilter.get());
}
+ @Test
+ public void testMalformedV2HeaderSignatureRejected() throws Exception {
+ headerValue.set(nodeName + " someuser 1234567890 not_base64!!!");
+
+ HttpServletResponse response = mock(HttpServletResponse.class);
+ assertFalse(
+ "Should have rejected request with a non-base64 signature",
+ mock.authenticate(mockReq, response, filterChain));
+
+ verify(response)
+ .setHeader(HttpHeader.WWW_AUTHENTICATE.asString(),
PKIAuthenticationPlugin.HEADER_V2);
+ verify(response).sendError(ArgumentMatchers.eq(401), anyString());
+
+ assertNull(
+ "Should not have proceeded after authentication failure",
wrappedRequestByFilter.get());
+ }
+
private HttpServletRequest createMockRequest(final AtomicReference<String>
headerValue) {
HttpServletRequest mockReq = mock(HttpServletRequest.class);
when(mockReq.getHeader(any(String.class)))
