[
https://issues.apache.org/jira/browse/SHIRO-582?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel
]
Christian Thum updated SHIRO-582:
---------------------------------
Description:
{{WebUtils.getRequestUri}} uses the {{normalize}} method to canonicalize the
request URI. During an automated pentest, we found that a request to the
following URL will cause a NPE:
{{curl --path-as-is
"http://127.0.0.1/\../\../\../\../\../\../Server4/admin-serv/config/adm.conf"}}
The request will cause the path parameter of the `doMatch`method in
org.apache.shiro.util.AntPathMatcher to be null. Executing the line
{quote}
{{ if (path.startsWith(this.pathSeparator) !=
pattern.startsWith(this.pathSeparator)) }} will throw the NPE.
{quote}
This could be handled by adjusting the {{normalize}} method or null checking
the path in the {{doMatch}} method.
*Stacktrace*
{quote}
java.lang.NullPointerException
at org.apache.shiro.util.AntPathMatcher.doMatch(AntPathMatcher.java:109)
at org.apache.shiro.util.AntPathMatcher.match(AntPathMatcher.java:90)
at org.apache.shiro.util.AntPathMatcher.matches(AntPathMatcher.java:86)
at
org.apache.shiro.web.filter.mgt.PathMatchingFilterChainResolver.pathMatches(PathMatchingFilterChainResolver.java:135)
at
org.apache.shiro.web.filter.mgt.PathMatchingFilterChainResolver.getChain(PathMatchingFilterChainResolver.java:106)
at
org.apache.shiro.web.servlet.AbstractShiroFilter.getExecutionChain(AbstractShiroFilter.java:415)
at
org.apache.shiro.web.servlet.AbstractShiroFilter.executeChain(AbstractShiroFilter.java:448)
{quote}
was:
{{WebUtils.getRequestUri}} uses the {{normalize}} method to canonicalize the
request URI. During an automated pentest, we found that a request following to
the following URL will cause a NPE:
{{curl --path-as-is
"http://127.0.0.1/\../\../\../\../\../\../Server4/admin-serv/config/adm.conf"}}
The request will cause the path parameter of the `doMatch`method in
org.apache.shiro.util.AntPathMatcher to be null. Executing the line
{quote}
{{ if (path.startsWith(this.pathSeparator) !=
pattern.startsWith(this.pathSeparator)) }} will throw the NPE.
{quote}
This could be handled by adjusting the {{normalize}} method or null checking
the path in the {{doMatch}} method.
*Stacktrace*
{quote}
java.lang.NullPointerException
at org.apache.shiro.util.AntPathMatcher.doMatch(AntPathMatcher.java:109)
at org.apache.shiro.util.AntPathMatcher.match(AntPathMatcher.java:90)
at org.apache.shiro.util.AntPathMatcher.matches(AntPathMatcher.java:86)
at
org.apache.shiro.web.filter.mgt.PathMatchingFilterChainResolver.pathMatches(PathMatchingFilterChainResolver.java:135)
at
org.apache.shiro.web.filter.mgt.PathMatchingFilterChainResolver.getChain(PathMatchingFilterChainResolver.java:106)
at
org.apache.shiro.web.servlet.AbstractShiroFilter.getExecutionChain(AbstractShiroFilter.java:415)
at
org.apache.shiro.web.servlet.AbstractShiroFilter.executeChain(AbstractShiroFilter.java:448)
{quote}
> NullPointerException in AntPathMatcher
> --------------------------------------
>
> Key: SHIRO-582
> URL: https://issues.apache.org/jira/browse/SHIRO-582
> Project: Shiro
> Issue Type: Bug
> Components: Authorization (access control)
> Affects Versions: 1.3.0
> Reporter: Christian Thum
>
> {{WebUtils.getRequestUri}} uses the {{normalize}} method to canonicalize the
> request URI. During an automated pentest, we found that a request to the
> following URL will cause a NPE:
> {{curl --path-as-is
> "http://127.0.0.1/\../\../\../\../\../\../Server4/admin-serv/config/adm.conf"}}
> The request will cause the path parameter of the `doMatch`method in
> org.apache.shiro.util.AntPathMatcher to be null. Executing the line
> {quote}
> {{ if (path.startsWith(this.pathSeparator) !=
> pattern.startsWith(this.pathSeparator)) }} will throw the NPE.
> {quote}
> This could be handled by adjusting the {{normalize}} method or null checking
> the path in the {{doMatch}} method.
> *Stacktrace*
> {quote}
> java.lang.NullPointerException
> at org.apache.shiro.util.AntPathMatcher.doMatch(AntPathMatcher.java:109)
> at org.apache.shiro.util.AntPathMatcher.match(AntPathMatcher.java:90)
> at org.apache.shiro.util.AntPathMatcher.matches(AntPathMatcher.java:86)
> at
> org.apache.shiro.web.filter.mgt.PathMatchingFilterChainResolver.pathMatches(PathMatchingFilterChainResolver.java:135)
> at
> org.apache.shiro.web.filter.mgt.PathMatchingFilterChainResolver.getChain(PathMatchingFilterChainResolver.java:106)
> at
> org.apache.shiro.web.servlet.AbstractShiroFilter.getExecutionChain(AbstractShiroFilter.java:415)
> at
> org.apache.shiro.web.servlet.AbstractShiroFilter.executeChain(AbstractShiroFilter.java:448)
> {quote}
--
This message was sent by Atlassian JIRA
(v6.3.4#6332)
