[
https://issues.apache.org/jira/browse/KNOX-2827?focusedWorklogId=819520&page=com.atlassian.jira.plugin.system.issuetabpanels:worklog-tabpanel#worklog-819520
]
ASF GitHub Bot logged work on KNOX-2827:
----------------------------------------
Author: ASF GitHub Bot
Created on: 24/Oct/22 07:46
Start Date: 24/Oct/22 07:46
Worklog Time Spent: 10m
Work Description: zeroflag commented on code in PR #650:
URL: https://github.com/apache/knox/pull/650#discussion_r1002972633
##########
gateway-spi/src/main/java/org/apache/knox/gateway/dispatch/GatewayDispatchFilter.java:
##########
@@ -145,14 +147,21 @@ private boolean isDispatchAllowed(HttpServletRequest
request) {
if (whitelist != null) {
String requestURI = request.getRequestURI();
- String decodedURL = null;
+ String decodedURL = requestURI;
try {
decodedURL = URLDecoder.decode(requestURI,
StandardCharsets.UTF_8.name());
} catch (UnsupportedEncodingException e) {
//
}
+ String baseUrl;
+ try {
+ URL url = new URL(decodedURL);
+ baseUrl = new URL(url.getProtocol(), url.getHost(), url.getPort(),
"").toString();
+ } catch (MalformedURLException e) {
+ throw new RuntimeException(e);
Review Comment:
Hi @moresandeep, if we log it here then the message will appear in the log
two times. I tested this with a malformed URL and the exception was still
visible in the gateway.log, because at the outer level we catch and log
everything. I don't see a reason to log it here too.
Issue Time Tracking
-------------------
Worklog Id: (was: 819520)
Time Spent: 20m (was: 10m)
> isDispatchAllowed should cut off path segments from the URL
> -----------------------------------------------------------
>
> Key: KNOX-2827
> URL: https://issues.apache.org/jira/browse/KNOX-2827
> Project: Apache Knox
> Issue Type: Bug
> Reporter: Attila Magyar
> Assignee: Attila Magyar
> Priority: Major
> Fix For: 2.0.0
>
> Time Spent: 20m
> Remaining Estimate: 0h
>
> In isDispatchAllowed we check the full URL against the whitelist regexp
> (including /path, but not including query parameters) which raises security
> concenrs.
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
