This is an automated email from the ASF dual-hosted git repository. dsmiley pushed a commit to branch branch_10x in repository https://gitbox.apache.org/repos/asf/solr.git
commit 5e8c46a7c4ef94b7e27ca59413501fefc23f586a Author: Jan Høydahl <[email protected]> AuthorDate: Wed Aug 5 11:43:13 2026 +0200 PKIAuthenticationPlugin: handle non-base64 SolrAuthV2 signature (#4553) (cherry picked from commit d9e1468dda4d00f20e211e51a69c095bc3be5457) --- .../unreleased/PR#4553-pki-v2-header-base64-fix.yml | 7 +++++++ .../apache/solr/security/PKIAuthenticationPlugin.java | 8 +++++++- .../solr/security/TestPKIAuthenticationPlugin.java | 17 +++++++++++++++++ 3 files changed, 31 insertions(+), 1 deletion(-) diff --git a/changelog/unreleased/PR#4553-pki-v2-header-base64-fix.yml b/changelog/unreleased/PR#4553-pki-v2-header-base64-fix.yml new file mode 100644 index 00000000000..9e503d01e70 --- /dev/null +++ b/changelog/unreleased/PR#4553-pki-v2-header-base64-fix.yml @@ -0,0 +1,7 @@ +title: PKIAuthenticationPlugin now rejects a SolrAuthV2 header with a malformed signature using a 401 response, instead of returning a 500 +type: fixed +authors: + - name: Jan Høydahl +links: + - name: PR#4553 + url: https://github.com/apache/solr/pull/4553 diff --git a/solr/core/src/java/org/apache/solr/security/PKIAuthenticationPlugin.java b/solr/core/src/java/org/apache/solr/security/PKIAuthenticationPlugin.java index 7c2eb80c28b..aef49c122ff 100644 --- a/solr/core/src/java/org/apache/solr/security/PKIAuthenticationPlugin.java +++ b/solr/core/src/java/org/apache/solr/security/PKIAuthenticationPlugin.java @@ -209,7 +209,13 @@ public class PKIAuthenticationPlugin extends AuthenticationPlugin int sigStart = header.lastIndexOf(' '); String data = header.substring(0, sigStart); - byte[] sig = Base64.getDecoder().decode(header.substring(sigStart + 1)); + byte[] sig; + try { + sig = Base64.getDecoder().decode(header.substring(sigStart + 1)); + } catch (IllegalArgumentException e) { + log.warn("Could not parse signature in SolrAuthV2 header as base64"); + return null; + } PKIHeaderData rv = validateSignature(data, sig, key, false); if (rv == null) { log.warn("Failed to verify signature, trying after refreshing the key "); diff --git a/solr/core/src/test/org/apache/solr/security/TestPKIAuthenticationPlugin.java b/solr/core/src/test/org/apache/solr/security/TestPKIAuthenticationPlugin.java index cff82ba6e7a..b19750cb564 100644 --- a/solr/core/src/test/org/apache/solr/security/TestPKIAuthenticationPlugin.java +++ b/solr/core/src/test/org/apache/solr/security/TestPKIAuthenticationPlugin.java @@ -207,6 +207,23 @@ public class TestPKIAuthenticationPlugin extends SolrTestCaseJ4 { "Should not have proceeded after authentication failure", wrappedRequestByFilter.get()); } + @Test + public void testMalformedV2HeaderSignatureRejected() throws Exception { + headerValue.set(nodeName + " someuser 1234567890 not_base64!!!"); + + HttpServletResponse response = mock(HttpServletResponse.class); + assertFalse( + "Should have rejected request with a non-base64 signature", + mock.authenticate(mockReq, response, filterChain)); + + verify(response) + .setHeader(HttpHeader.WWW_AUTHENTICATE.asString(), PKIAuthenticationPlugin.HEADER_V2); + verify(response).sendError(ArgumentMatchers.eq(401), anyString()); + + assertNull( + "Should not have proceeded after authentication failure", wrappedRequestByFilter.get()); + } + private HttpServletRequest createMockRequest(final AtomicReference<String> headerValue) { HttpServletRequest mockReq = mock(HttpServletRequest.class); when(mockReq.getHeader(any(String.class)))
