This is an automated email from the ASF dual-hosted git repository. asf-gitbox-commits pushed a commit to branch UNOMI-972-credentials-profile-binding-privileged-rest in repository https://gitbox.apache.org/repos/asf/unomi.git
commit 04d1c4579ca03e7c83d01c695cc361f993a49996 Author: Serge Huber <[email protected]> AuthorDate: Mon Aug 10 09:27:03 2026 +0200 UNOMI-972: restrict router import/export configuration to system administrators Reported issue 5. An ImportConfiguration's properties.source is a raw Apache Camel endpoint URI, guarded only by a scheme allowlist that permits file, ftp, sftp and ftps with no path canonicalisation or host validation. A tenant administrator could therefore read arbitrary server files into profile properties, or reach internal hosts - authority well outside that tenant's data plane. The same allowlist governs the export destinationEndpoint. Both endpoints now require the system ADMINISTRATOR role, which closes the reported reach. Confining the paths and hosts themselves is defence in depth against an actor who is already a system administrator, and is tracked separately. Co-Authored-By: Claude Opus 5 (1M context) <[email protected]> --- .../src/main/feature/feature.xml | 2 + extensions/router/router-rest/pom.xml | 10 +++++ .../rest/ExportConfigurationServiceEndPoint.java | 3 ++ .../rest/ImportConfigurationServiceEndPoint.java | 3 ++ .../rest/RouterConfigurationEndPointRoleTest.java | 44 ++++++++++++++++++++++ 5 files changed, 62 insertions(+) diff --git a/extensions/router/router-karaf-feature/src/main/feature/feature.xml b/extensions/router/router-karaf-feature/src/main/feature/feature.xml index 647b80914..800508f90 100644 --- a/extensions/router/router-karaf-feature/src/main/feature/feature.xml +++ b/extensions/router/router-karaf-feature/src/main/feature/feature.xml @@ -20,6 +20,8 @@ <details>Apache Karaf feature for the Apache Unomi Context Server extension</details> <feature>wrap</feature> <feature>unomi-services</feature> + <!-- REST endpoints use @RequiresRole from org.apache.unomi.rest.security --> + <feature>unomi-rest-api</feature> <bundle start="false">mvn:org.apache.servicemix.bundles/org.apache.servicemix.bundles.jsch/0.1.55_1</bundle> <bundle start="false">mvn:commons-net/commons-net/${commons-net.version}</bundle> <bundle start="false">wrap:mvn:org.apache.kafka/kafka-clients/${kafka.client.version}</bundle> diff --git a/extensions/router/router-rest/pom.xml b/extensions/router/router-rest/pom.xml index b7b9233db..5d7f84404 100644 --- a/extensions/router/router-rest/pom.xml +++ b/extensions/router/router-rest/pom.xml @@ -55,6 +55,11 @@ <artifactId>unomi-router-api</artifactId> <scope>provided</scope> </dependency> + <dependency> + <groupId>org.apache.unomi</groupId> + <artifactId>unomi-rest</artifactId> + <scope>provided</scope> + </dependency> <dependency> <groupId>org.osgi</groupId> @@ -103,6 +108,11 @@ <artifactId>slf4j-api</artifactId> <scope>provided</scope> </dependency> + <dependency> + <groupId>org.junit.jupiter</groupId> + <artifactId>junit-jupiter</artifactId> + <scope>test</scope> + </dependency> </dependencies> <build> diff --git a/extensions/router/router-rest/src/main/java/org/apache/unomi/router/rest/ExportConfigurationServiceEndPoint.java b/extensions/router/router-rest/src/main/java/org/apache/unomi/router/rest/ExportConfigurationServiceEndPoint.java index 4371e2d13..a77325160 100644 --- a/extensions/router/router-rest/src/main/java/org/apache/unomi/router/rest/ExportConfigurationServiceEndPoint.java +++ b/extensions/router/router-rest/src/main/java/org/apache/unomi/router/rest/ExportConfigurationServiceEndPoint.java @@ -17,7 +17,9 @@ package org.apache.unomi.router.rest; import org.apache.cxf.rs.security.cors.CrossOriginResourceSharing; +import org.apache.unomi.api.security.UnomiRoles; import org.apache.unomi.api.services.ProfileService; +import org.apache.unomi.rest.security.RequiresRole; import org.apache.unomi.router.api.ExportConfiguration; import org.apache.unomi.router.api.services.ImportExportConfigurationService; import org.apache.unomi.router.api.services.ProfileExportService; @@ -47,6 +49,7 @@ import java.util.List; allowCredentials = true ) @Path("/exportConfiguration") +@RequiresRole(UnomiRoles.ADMINISTRATOR) @Component(service=ExportConfigurationServiceEndPoint.class,property = "osgi.jaxrs.resource=true") public class ExportConfigurationServiceEndPoint extends AbstractConfigurationServiceEndpoint<ExportConfiguration> { diff --git a/extensions/router/router-rest/src/main/java/org/apache/unomi/router/rest/ImportConfigurationServiceEndPoint.java b/extensions/router/router-rest/src/main/java/org/apache/unomi/router/rest/ImportConfigurationServiceEndPoint.java index e8d639df1..cbc7dcec3 100644 --- a/extensions/router/router-rest/src/main/java/org/apache/unomi/router/rest/ImportConfigurationServiceEndPoint.java +++ b/extensions/router/router-rest/src/main/java/org/apache/unomi/router/rest/ImportConfigurationServiceEndPoint.java @@ -19,7 +19,9 @@ package org.apache.unomi.router.rest; import org.apache.cxf.jaxrs.ext.multipart.Attachment; import org.apache.cxf.jaxrs.ext.multipart.Multipart; import org.apache.cxf.rs.security.cors.CrossOriginResourceSharing; +import org.apache.unomi.api.security.UnomiRoles; import org.apache.unomi.api.services.ConfigSharingService; +import org.apache.unomi.rest.security.RequiresRole; import org.apache.unomi.router.api.ImportConfiguration; import org.apache.unomi.router.api.RouterConstants; import org.apache.unomi.router.api.services.ImportExportConfigurationService; @@ -54,6 +56,7 @@ import java.util.List; allowCredentials = true ) @Path("/importConfiguration") +@RequiresRole(UnomiRoles.ADMINISTRATOR) @Component(service=ImportConfigurationServiceEndPoint.class,property = "osgi.jaxrs.resource=true") public class ImportConfigurationServiceEndPoint extends AbstractConfigurationServiceEndpoint<ImportConfiguration> { diff --git a/extensions/router/router-rest/src/test/java/org/apache/unomi/router/rest/RouterConfigurationEndPointRoleTest.java b/extensions/router/router-rest/src/test/java/org/apache/unomi/router/rest/RouterConfigurationEndPointRoleTest.java new file mode 100644 index 000000000..ab9cfb8b3 --- /dev/null +++ b/extensions/router/router-rest/src/test/java/org/apache/unomi/router/rest/RouterConfigurationEndPointRoleTest.java @@ -0,0 +1,44 @@ +/* + * Licensed to the Apache Software Foundation (ASF) under one or more + * contributor license agreements. See the NOTICE file distributed with + * this work for additional information regarding copyright ownership. + * The ASF licenses this file to You under the Apache License, Version 2.0 + * (the "License"); you may not use this file except in compliance with + * the License. You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ +package org.apache.unomi.router.rest; + +import org.apache.unomi.api.security.UnomiRoles; +import org.apache.unomi.rest.security.RequiresRole; +import org.junit.jupiter.api.Test; + +import static org.junit.jupiter.api.Assertions.assertArrayEquals; +import static org.junit.jupiter.api.Assertions.assertNotNull; + +/** + * Regression: router import/export configuration must stay restricted to system administrators. + */ +class RouterConfigurationEndPointRoleTest { + + @Test + void importEndpointRequiresSystemAdministratorRole() { + RequiresRole requiresRole = ImportConfigurationServiceEndPoint.class.getAnnotation(RequiresRole.class); + assertNotNull(requiresRole, "ImportConfigurationServiceEndPoint must declare @RequiresRole"); + assertArrayEquals(new String[]{UnomiRoles.ADMINISTRATOR}, requiresRole.value()); + } + + @Test + void exportEndpointRequiresSystemAdministratorRole() { + RequiresRole requiresRole = ExportConfigurationServiceEndPoint.class.getAnnotation(RequiresRole.class); + assertNotNull(requiresRole, "ExportConfigurationServiceEndPoint must declare @RequiresRole"); + assertArrayEquals(new String[]{UnomiRoles.ADMINISTRATOR}, requiresRole.value()); + } +}
