[jira] [Work logged] (KNOX-3458) Enforce a maximum actor-chain (act claim) depth in token exchange

[ASF GitHub Bot (Jira)]

     [ 
https://issues.apache.org/jira/browse/KNOX-3458?focusedWorklogId=1041671&page=com.atlassian.jira.plugin.system.issuetabpanels:worklog-tabpanel#worklog-1041671
 ]

ASF GitHub Bot logged work on KNOX-3458:
----------------------------------------

                Author: ASF GitHub Bot
            Created on: 15/Sep/26 13:19
            Start Date: 15/Sep/26 13:19
    Worklog Time Spent: 10m 
      Work Description: github-actions[bot] commented on PR #1400:
URL: https://github.com/apache/knox/pull/1400#issuecomment-5680843167

   ## Test Results
     5 files    5 suites   30s ⏱️
    90 tests  90 ✅ 0 💤 0 ❌
   108 runs  108 ✅ 0 💤 0 ❌
   
   Results for commit 7af92361.
   
   
[test-results]:data:application/gzip;base64,H4sIAMpFqWoC/13MSw6DIBSF4a0Yxh0Aokg308AVkpuqNDxGpnsvGqu0w+8/yVmJw8lGcm+6W0NixnRizEEn9EthS4vLkrZNnXjEDPBXnvgq5QpO4/QTbAg+HCXkZXtkdDjwfazL9bi7Otxd/4GfZ0wFRGqneNsz6I3kQgmhrR5bCY5S03GwBtjgJDXk/QHlc9srAgEAAA==
   




Issue Time Tracking
-------------------

    Worklog Id:     (was: 1041671)
    Time Spent: 0.5h  (was: 20m)

> Enforce a maximum actor-chain (act claim) depth in token exchange
> -----------------------------------------------------------------
>
>                 Key: KNOX-3458
>                 URL: https://issues.apache.org/jira/browse/KNOX-3458
>             Project: Apache Knox
>          Issue Type: Sub-task
>          Components: Server
>    Affects Versions: 3.1.0
>            Reporter: Sandor Molnar
>            Assignee: Sandor Molnar
>            Priority: Major
>             Fix For: 3.1.0
>
>          Time Spent: 0.5h
>  Remaining Estimate: 0h
>
> The RFC 8693 act claim chain is walked and rebuilt with no depth bound 
> anywhere: {{TokenUtils.extractActorChain()}}, {{addActorToChain()}}, and 
> {{buildNestedActClaim()}} all iterate unbounded, and 
> {{ActorChainPrincipalImpl}} does no validation. A deeply nested act claim can 
> grow without limit across successive delegation exchanges.
> Scope: Add a configurable maximum chain depth (e.g. 
> {{delegation.max.actor.chain.depth}}) and enforce it at the point the chain 
> is about to grow - TokenResource.handleDelegatedAuthentication() / 
> TokenUtils.addActorToChain() (last chance before minting), rejecting the 
> exchange when the resulting depth would exceed the bound. Default to 10.
> Note: {{TokenExchangeHandler.auditMessage()}} already lists 
> {{act_chain_depth}} as a deliberately-omitted field.  Audit it once enforced.



--
This message was sent by Atlassian Jira
(v8.20.10#820010)