Federico Mariani created CAMEL-24178:
----------------------------------------
Summary: camel-cxfrs - producer matrix/query parsing throws on
legal request URIs (valueless params, bridge scenario)
Key: CAMEL-24178
URL: https://issues.apache.org/jira/browse/CAMEL-24178
Project: Camel
Issue Type: Bug
Components: camel-cxfrs
Reporter: Federico Mariani
Assignee: Federico Mariani
*Severity:* High
h3. Problem
On a cxfrs consumer -> cxfrs producer bridge (i.e. when {{CamelCxfMessage}} is
present), the producer parses the raw untrusted inbound request URI and query
string, and throws on inputs that are perfectly legal per RFC 3986:
# {{setupClientMatrix}} computes {{matrixStart = requestURL.indexOf(';')}} and
{{matrixEnd = requestURL.indexOf('?')}}. When a {{;}} appears *inside* the
query string (legal, and some CXF transports put path+query into
{{org.apache.cxf.request.uri}}), {{requestURL.substring(matrixStart+1,
matrixEnd)}} is called with {{begin > end}} ->
{{StringIndexOutOfBoundsException}}.
# {{getMatrixParametersFromMatrixString}} throws {{IllegalArgumentException}}
for any valueless matrix segment ({{/path;flag}} -> segment {{flag}} has no
{{=}}).
# {{insertQueryParametersFromQueryString}} throws
{{IllegalArgumentException("Invalid parameter, expected to be a pair...")}} for
any valueless query token ({{?debug}}, {{?trace}}).
h3. Impact
An external client can force an unhandled exception (HTTP 500) with a
well-formed request such as {{GET /svc/x;flag}} or {{GET
/bridged/endpoint?trace}}. Attacker-controllable and repeatable.
h3. Location
{{components/camel-cxf/camel-cxf-rest/src/main/java/org/apache/camel/component/cxf/jaxrs/CxfRsProducer.java}}
at ~265-286 (matrix), ~507-519 (query), ~571-585 (matrix parse).
h3. Fix
Compute {{matrixStart}} only within the pre-{{?}} portion:
{{requestURL.substring(0, matrixEnd).indexOf(';')}}. Treat valueless
matrix/query segments as empty-value params ({{client.query(name)}} / matrix
param with empty value) instead of throwing.
h3. Reproduction
Route: {{from("cxfrs://.../consumer").to("cxfrs://http://backend/svc";)}}. Call
the consumer with a URI containing a valueless query/matrix parameter; the
producer throws before invoking the backend. A focused unit test can drive the
private parsing helpers via a producer invoke with a synthesized
{{CamelCxfMessage}} / {{CamelHttpQuery}}.
----
_Filed by Claude Code (Claude Fable) on behalf of Federico Mariani (GitHub:
Croway). Findings from an AI-assisted code review of the camel-cxf component
family; each item was verified against the current source and git history.
Items marked *[reproducer attached]* include a failing JUnit test that
demonstrates the defect._
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
