[
https://issues.apache.org/jira/browse/CAMEL-24937?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel
]
Work on CAMEL-24937 started by Andrea Cosentino.
------------------------------------------------
> camel-pqc: confine FileBasedKeyLifecycleManager key file resolution to the
> configured directory
> -----------------------------------------------------------------------------------------------
>
> Key: CAMEL-24937
> URL: https://issues.apache.org/jira/browse/CAMEL-24937
> Project: Camel
> Issue Type: Improvement
> Components: camel-pqc
> Reporter: Andrea Cosentino
> Assignee: Andrea Cosentino
> Priority: Minor
>
> FileBasedKeyLifecycleManager resolves key file paths from the keyId directly
> under the configured key directory:
> {code:java}
> keyDirectory.resolve(keyId + ".private.json");
> keyDirectory.resolve(keyId + ".public.json");
> keyDirectory.resolve(keyId + ".metadata");
> keyDirectory.resolve(keyId + ".key");
> {code}
> There is no validation that the resulting path stays within keyDirectory. A
> keyId containing path separators, parent references ("..") or an absolute
> path would resolve to a location outside the configured directory. keyId
> values flow in from the CamelPQCKeyId / CamelPQCNewKeyId headers via the
> generateKeyPair / rotateKey / getKeyMetadata / expireKey / revokeKey /
> deleteKeyState operations.
> As defensive hardening, the manager should validate/confine keyId before
> using it to build a path - e.g. reject separators, ".." and absolute paths,
> and/or normalize the resolved path and verify it startsWith(keyDirectory)
> before any read/write/delete - so all key-file operations stay inside the
> configured directory regardless of the keyId value supplied by the route.
> A shared helper could be applied consistently; the cloud-backed managers
> (AwsSecretsManagerKeyLifecycleManager / AzureKeyVaultKeyLifecycleManager)
> build provider-side names validated by the provider, so only the file-based
> manager needs the filesystem confinement.
> Add tests covering keyId values with "..", path separators and absolute
> paths, asserting the operation is rejected (or safely confined) rather than
> touching a file outside keyDirectory.
> Affected: FileBasedKeyLifecycleManager in camel-pqc (main, 4.22.x, 4.18.x).
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
