[
https://issues.apache.org/jira/browse/CAMEL-24178?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel
]
Claus Ibsen reassigned CAMEL-24178:
-----------------------------------
Assignee: Claus Ibsen (was: Federico Mariani)
> camel-cxfrs - producer matrix/query parsing throws on legal request URIs
> (valueless params, bridge scenario)
> ------------------------------------------------------------------------------------------------------------
>
> Key: CAMEL-24178
> URL: https://issues.apache.org/jira/browse/CAMEL-24178
> Project: Camel
> Issue Type: Bug
> Components: camel-cxfrs
> Reporter: Federico Mariani
> Assignee: Claus Ibsen
> Priority: Major
>
> *Severity:* High
> h3. Problem
> On a cxfrs consumer -> cxfrs producer bridge (i.e. when {{CamelCxfMessage}}
> is present), the producer parses the raw untrusted inbound request URI and
> query string, and throws on inputs that are perfectly legal per RFC 3986:
> # {{setupClientMatrix}} computes {{matrixStart = requestURL.indexOf(';')}}
> and {{matrixEnd = requestURL.indexOf('?')}}. When a {{;}} appears *inside*
> the query string (legal, and some CXF transports put path+query into
> {{org.apache.cxf.request.uri}}), {{requestURL.substring(matrixStart+1,
> matrixEnd)}} is called with {{begin > end}} ->
> {{StringIndexOutOfBoundsException}}.
> # {{getMatrixParametersFromMatrixString}} throws {{IllegalArgumentException}}
> for any valueless matrix segment ({{/path;flag}} -> segment {{flag}} has no
> {{=}}).
> # {{insertQueryParametersFromQueryString}} throws
> {{IllegalArgumentException("Invalid parameter, expected to be a pair...")}}
> for any valueless query token ({{?debug}}, {{?trace}}).
> h3. Impact
> An external client can force an unhandled exception (HTTP 500) with a
> well-formed request such as {{GET /svc/x;flag}} or {{GET
> /bridged/endpoint?trace}}. Attacker-controllable and repeatable.
> h3. Location
> {{components/camel-cxf/camel-cxf-rest/src/main/java/org/apache/camel/component/cxf/jaxrs/CxfRsProducer.java}}
> at ~265-286 (matrix), ~507-519 (query), ~571-585 (matrix parse).
> h3. Fix
> Compute {{matrixStart}} only within the pre-{{?}} portion:
> {{requestURL.substring(0, matrixEnd).indexOf(';')}}. Treat valueless
> matrix/query segments as empty-value params ({{client.query(name)}} / matrix
> param with empty value) instead of throwing.
> h3. Reproduction
> Route: {{from("cxfrs://.../consumer").to("cxfrs://http://backend/svc";)}}.
> Call the consumer with a URI containing a valueless query/matrix parameter;
> the producer throws before invoking the backend. A focused unit test can
> drive the private parsing helpers via a producer invoke with a synthesized
> {{CamelCxfMessage}} / {{CamelHttpQuery}}.
> ----
> _Filed by Claude Code (Claude Fable) on behalf of Federico Mariani (GitHub:
> Croway). Findings from an AI-assisted code review of the camel-cxf component
> family; each item was verified against the current source and git history.
> Items marked *[reproducer attached]* include a failing JUnit test that
> demonstrates the defect._
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
