Joerg Hoh created SLING-13382:
---------------------------------
Summary: Limit parent traversal in DeepReadValueMapDecorator
Key: SLING-13382
URL: https://issues.apache.org/jira/browse/SLING-13382
Project: Sling
Issue Type: Task
Components: API
Reporter: Joerg Hoh
h2. Problem
{{DeepReadValueMapDecorator}} resolves the resource portion of a deep-read key
without checking whether the target remains within the starting resource's
subtree.
For example, given a resource at {{/content/site/page}}:
{code:java}
valueMap.get("../otherpage/jcr:content/title", String.class);
{code}
The decorator resolves {{/content/site/page/../otherpage/jcr:content}}, which
points to {{/content/site/otherpage/jcr:content}}, outside the starting subtree.
This behavior affects {{get(Object)}}, {{get(String, Class)}}, {{get(String,
Object)}} and {{containsKey(Object)}}.
h2. Potential impact
If a consumer accepts externally controlled deep-read keys and uses a
privileged service resolver, it may expose properties outside the intended
subtree.
Reads remain subject to the backing resolver's permissions; this is not a
resolver ACL bypass. Consumers using fixed keys or appropriately restricted
resolvers may not be affected.
h2. Compatibility considerations
{{ResourceResolver.getResource()}} explicitly supports resolving {{.}} and
{{..}} segments. The {{ValueMap}} documentation describes deep reads as
equivalent to child-resource lookup but does not explicitly guarantee subtree
containment.
Restricting parent traversal therefore requires assessing existing consumers
and intended API behavior. {{AbstractResource.getValueMap()}} uses this
decorator only when direct adaptation to {{ValueMap}} fails.
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
