[
https://issues.apache.org/jira/browse/CAMEL-24412?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel
]
Andrea Cosentino updated CAMEL-24412:
-------------------------------------
Fix Version/s: 4.18.5
4.22.1
> camel-netty-http - security constraint lookup must use the same
> case-insensitive path matching as dispatch
> ----------------------------------------------------------------------------------------------------------
>
> Key: CAMEL-24412
> URL: https://issues.apache.org/jira/browse/CAMEL-24412
> Project: Camel
> Issue Type: Bug
> Components: camel-netty-http
> Reporter: Andrea Cosentino
> Assignee: Andrea Cosentino
> Priority: Major
> Fix For: 4.22.1, 4.23.0, 4.18.5
>
>
> HttpServerChannelHandler.extractTarget() strips the endpoint context-path
> from the request target so the security constraint can be evaluated relative
> to the endpoint:
> String path = consumer.getConfiguration().getPath();
> if (path != null && target.startsWith(path)) {
> // need to match by lower case as we want to ignore case on
> context-path
> path = path.toLowerCase(Locale.US);
> String match = target.toLowerCase(Locale.US);
> if (match.startsWith(path)) {
> target = target.substring(path.length());
> }
> }
> The outer guard is case-sensitive, so the inner case-insensitive comparison
> can never change the outcome - it is dead code. When the request path differs
> from the configured path only by case the strip does not happen and
> SecurityConstraint.restricted() is evaluated against the unstripped,
> differently-cased target.
> Consumer dispatch does not have this property:
> RestConsumerContextPathMatcher.matchPath() uses equalsIgnoreCase() and a
> lower-cased prefix comparison, so the request still reaches the route.
> Authorization and dispatch therefore disagree about which endpoint a request
> belongs to.
> Proposal: perform the strip on the case-insensitive comparison (drop the
> case-sensitive outer guard) so that both the constraint lookup and dispatch
> consume the same normalised path. Worth a regression test asserting that a
> differently-cased context path yields the same constraint decision.
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
