Andrea Cosentino created CAMEL-24412:
----------------------------------------
Summary: camel-netty-http - security constraint lookup must use
the same case-insensitive path matching as dispatch
Key: CAMEL-24412
URL: https://issues.apache.org/jira/browse/CAMEL-24412
Project: Camel
Issue Type: Bug
Components: camel-netty-http
Reporter: Andrea Cosentino
Assignee: Andrea Cosentino
Fix For: 4.23.0
HttpServerChannelHandler.extractTarget() strips the endpoint context-path from
the request target so the security constraint can be evaluated relative to the
endpoint:
String path = consumer.getConfiguration().getPath();
if (path != null && target.startsWith(path)) {
// need to match by lower case as we want to ignore case on context-path
path = path.toLowerCase(Locale.US);
String match = target.toLowerCase(Locale.US);
if (match.startsWith(path)) {
target = target.substring(path.length());
}
}
The outer guard is case-sensitive, so the inner case-insensitive comparison can
never change the outcome - it is dead code. When the request path differs from
the configured path only by case the strip does not happen and
SecurityConstraint.restricted() is evaluated against the unstripped,
differently-cased target.
Consumer dispatch does not have this property:
RestConsumerContextPathMatcher.matchPath() uses equalsIgnoreCase() and a
lower-cased prefix comparison, so the request still reaches the route.
Authorization and dispatch therefore disagree about which endpoint a request
belongs to.
Proposal: perform the strip on the case-insensitive comparison (drop the
case-sensitive outer guard) so that both the constraint lookup and dispatch
consume the same normalised path. Worth a regression test asserting that a
differently-cased context path yields the same constraint decision.
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
