Andrea Cosentino created CAMEL-24438:
----------------------------------------
Summary: camel-platform-http-main - static file serving resolves
against the process working directory and the classpath root
Key: CAMEL-24438
URL: https://issues.apache.org/jira/browse/CAMEL-24438
Project: Camel
Issue Type: Bug
Components: camel-platform-http
Reporter: Andrea Cosentino
Assignee: Andrea Cosentino
Fix For: 4.23.0
{{MainHttpServer.setupStatic()}} mounts a catch-all route at
{{staticContextPath}} + {{"*"}} (default {{"/"}}) and resolves the requested
path like this:
{code:java}
String u = ctx.normalizedPath();
...
File f = new File(u);
if (!f.exists() && staticSourceDir != null) {
f = new File(staticSourceDir, u);
}
if (f.exists()) {
is = new FileInputStream(f);
} else {
is = camelContext.getClassResolver().loadResourceAsStream(u);
if (is == null) {
is =
camelContext.getClassResolver().loadResourceAsStream("META-INF/resources/" + u);
}
...
}
{code}
{{new File(u)}} resolves relative to the process working directory, and it is
tried *first*. {{staticSourceDir}} is only consulted when that misses, so it
behaves as a fallback location rather than as a root the lookup is confined to.
The classpath root is then tried as well. There is no extension allowlist and
no denylist.
camel-main and camel-jbang deployments conventionally keep
{{application.properties}} in the working directory, and the route is
registered at {{order(Integer.MAX_VALUE)}} so it answers anything no consumer
matched. Vert.x path normalization does prevent {{../}} escapes, but the
working directory and the classpath are already the roots being served.
Proposal: make {{staticSourceDir}} an actual root - resolve every request under
it and reject anything that escapes - and confine the classpath lookup to a
dedicated prefix such as {{META-INF/resources/}} instead of the classpath root.
Needs an upgrade-guide entry, since deployments relying on working-directory
resolution would have to set {{staticSourceDir}}.
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
