[
https://issues.apache.org/jira/browse/CAMEL-24412?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=18106976#comment-18106976
]
Andrea Cosentino commented on CAMEL-24412:
------------------------------------------
Fixed on main via https://github.com/apache/camel/pull/25578 (4.23.0). The
netty-http security-constraint lookup now uses the same case-insensitive path
matching as request dispatch, closing a path-casing mismatch that could bypass
a configured security constraint. Given the auth-bypass impact, a backport to
the maintenance branches should be evaluated.
> camel-netty-http - security constraint lookup must use the same
> case-insensitive path matching as dispatch
> ----------------------------------------------------------------------------------------------------------
>
> Key: CAMEL-24412
> URL: https://issues.apache.org/jira/browse/CAMEL-24412
> Project: Camel
> Issue Type: Bug
> Components: camel-netty-http
> Reporter: Andrea Cosentino
> Assignee: Andrea Cosentino
> Priority: Major
> Fix For: 4.23.0
>
>
> HttpServerChannelHandler.extractTarget() strips the endpoint context-path
> from the request target so the security constraint can be evaluated relative
> to the endpoint:
> String path = consumer.getConfiguration().getPath();
> if (path != null && target.startsWith(path)) {
> // need to match by lower case as we want to ignore case on
> context-path
> path = path.toLowerCase(Locale.US);
> String match = target.toLowerCase(Locale.US);
> if (match.startsWith(path)) {
> target = target.substring(path.length());
> }
> }
> The outer guard is case-sensitive, so the inner case-insensitive comparison
> can never change the outcome - it is dead code. When the request path differs
> from the configured path only by case the strip does not happen and
> SecurityConstraint.restricted() is evaluated against the unstripped,
> differently-cased target.
> Consumer dispatch does not have this property:
> RestConsumerContextPathMatcher.matchPath() uses equalsIgnoreCase() and a
> lower-cased prefix comparison, so the request still reaches the route.
> Authorization and dispatch therefore disagree about which endpoint a request
> belongs to.
> Proposal: perform the strip on the case-insensitive comparison (drop the
> case-sensitive outer guard) so that both the constraint lookup and dispatch
> consume the same normalised path. Worth a regression test asserting that a
> differently-cased context path yields the same constraint decision.
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
