Christian Thum created SHIRO-582:
------------------------------------
Summary: NullPointerException in AntPathMatcher
Key: SHIRO-582
URL: https://issues.apache.org/jira/browse/SHIRO-582
Project: Shiro
Issue Type: Bug
Components: Authorization (access control)
Affects Versions: 1.3.0
Reporter: Christian Thum
`WebUtils.getRequestUri` uses the `normalize`method to canonicalize the
request URI. During an automated pentest, we found that a request following to
the following URL will cause a NPE:
`curl --path-as-is
"http://127.0.0.1/\../\../\../\../\../\../Server4/admin-serv/config/adm.conf"`
The request will cause the path parameter of the `doMatch`method in
org.apache.shiro.util.AntPathMatcher to be null. Executing the line
` if (path.startsWith(this.pathSeparator) !=
pattern.startsWith(this.pathSeparator)) {` will throw the NPE.
This could be handled by adjusting the normalize method or null checking the
path in the doMatch method.
--
This message was sent by Atlassian JIRA
(v6.3.4#6332)
