[
https://issues.apache.org/jira/browse/KNOX-2827?focusedWorklogId=819095&page=com.atlassian.jira.plugin.system.issuetabpanels:worklog-tabpanel#worklog-819095
]
ASF GitHub Bot logged work on KNOX-2827:
----------------------------------------
Author: ASF GitHub Bot
Created on: 21/Oct/22 11:05
Start Date: 21/Oct/22 11:05
Worklog Time Spent: 10m
Work Description: moresandeep commented on code in PR #650:
URL: https://github.com/apache/knox/pull/650#discussion_r1001661250
##########
gateway-spi/src/main/java/org/apache/knox/gateway/dispatch/GatewayDispatchFilter.java:
##########
@@ -145,14 +147,21 @@ private boolean isDispatchAllowed(HttpServletRequest
request) {
if (whitelist != null) {
String requestURI = request.getRequestURI();
- String decodedURL = null;
+ String decodedURL = requestURI;
try {
decodedURL = URLDecoder.decode(requestURI,
StandardCharsets.UTF_8.name());
} catch (UnsupportedEncodingException e) {
//
}
+ String baseUrl;
+ try {
+ URL url = new URL(decodedURL);
+ baseUrl = new URL(url.getProtocol(), url.getHost(), url.getPort(),
"").toString();
+ } catch (MalformedURLException e) {
+ throw new RuntimeException(e);
Review Comment:
We should log the error before wrapping the exception and throwing.
Issue Time Tracking
-------------------
Worklog Id: (was: 819095)
Remaining Estimate: 0h
Time Spent: 10m
> isDispatchAllowed should cut off path segments from the URL
> -----------------------------------------------------------
>
> Key: KNOX-2827
> URL: https://issues.apache.org/jira/browse/KNOX-2827
> Project: Apache Knox
> Issue Type: Bug
> Reporter: Attila Magyar
> Assignee: Attila Magyar
> Priority: Major
> Fix For: 2.0.0
>
> Time Spent: 10m
> Remaining Estimate: 0h
>
> In isDispatchAllowed we check the full URL against the whitelist regexp
> (including /path, but not including query parameters) which raises security
> concenrs.
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
