[
https://issues.apache.org/jira/browse/SLING-13382?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel
]
Joerg Hoh updated SLING-13382:
------------------------------
Summary: Warn on parent traversal in DeepReadValueMapDecorator (was: Limit
parent traversal in DeepReadValueMapDecorator)
> Warn on parent traversal in DeepReadValueMapDecorator
> -----------------------------------------------------
>
> Key: SLING-13382
> URL: https://issues.apache.org/jira/browse/SLING-13382
> Project: Sling
> Issue Type: Task
> Components: API
> Reporter: Joerg Hoh
> Priority: Major
>
> h2. Problem
> {{DeepReadValueMapDecorator}} resolves the resource portion of a deep-read
> key without checking whether the target remains within the starting
> resource's subtree.
> For example, given a resource at {{/content/site/page}}:
> {code:java}
> valueMap.get("../otherpage/jcr:content/title", String.class);
> {code}
> The decorator resolves {{/content/site/page/../otherpage/jcr:content}}, which
> points to {{/content/site/otherpage/jcr:content}}, outside the starting
> subtree.
> This behavior affects {{get(Object)}}, {{get(String, Class)}}, {{get(String,
> Object)}} and {{containsKey(Object)}}.
> h2. Potential impact
> If a consumer accepts externally controlled deep-read keys and uses a
> privileged service resolver, it may expose properties outside the intended
> subtree.
> Reads remain subject to the backing resolver's permissions; this is not a
> resolver ACL bypass. Consumers using fixed keys or appropriately restricted
> resolvers may not be affected.
> h2. Compatibility considerations
> {{ResourceResolver.getResource()}} explicitly supports resolving {{.}} and
> {{..}} segments. The {{ValueMap}} documentation describes deep reads as
> equivalent to child-resource lookup but does not explicitly guarantee subtree
> containment.
> Restricting parent traversal therefore requires assessing existing consumers
> and intended API behavior. {{AbstractResource.getValueMap()}} uses this
> decorator only when direct adaptation to {{ValueMap}} fails.
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
