[
https://issues.apache.org/jira/browse/FELIX-6854?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=18101622#comment-18101622
]
Konrad Windszus edited comment on FELIX-6854 at 8/4/26 7:17 AM:
----------------------------------------------------------------
For me [normalizing means resolving
{{..}}|https://docs.oracle.com/javase/8/docs/api/java/nio/file/Path.html#normalize--]
which is not happening as far as I can see. All resource names are used as
is. I agree though that the risk is low. I haven't checked all possible code
paths if some classloaders may actually try to interpret {{..}} like in
filesystem paths. However I would consider that a flaw in the affected
classloaders.
was (Author: kwin):
For me [normalizing means resolving
{{..}}|https://docs.oracle.com/javase/8/docs/api/java/nio/file/Path.html#normalize--]
which is not happening as far as I can see. I agree though that the risk is
low. I haven't checked all possible code paths if some classloaders may
actually try to interpret {{..}} like in filesystem paths. However I would
consider that a flaw in the affected classloaders.
> AbstractServlet.spoolResource delivers arbitrary resources having prefix
> "/res/" visible to classloader
> -------------------------------------------------------------------------------------------------------
>
> Key: FELIX-6854
> URL: https://issues.apache.org/jira/browse/FELIX-6854
> Project: Felix
> Issue Type: Bug
> Components: Web Console
> Affects Versions: webconsole-5.0.18
> Reporter: Konrad Windszus
> Priority: Major
>
> There is no limitation on resource names in
> https://github.com/apache/felix-dev/blob/762b769b60b41e139fce4a3c1b2c0bb1b2569155/webconsole/src/main/java/org/apache/felix/webconsole/servlet/AbstractServlet.java#L127
> which allows to expose arbitrary class files via the Felix WebConsole.
> Only the underlying bundle classloader may limit visibility.
> Although usually only admin like users have access to the Felix WebConsole,
> exposing all classloader resources unnecessarily may leak sensitive
> information.
> Would be best if each web console plugin maintains an allow list which
> resources may be requested but this would probably require a non backwards
> compatible fix.
> The same issue occurs in the deprecated AbstractWebConsolePlugin
> (https://github.com/apache/felix-dev/blob/762b769b60b41e139fce4a3c1b2c0bb1b2569155/webconsole/src/main/java/org/apache/felix/webconsole/AbstractWebConsolePlugin.java#L483).
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
