Andrea Cosentino created CAMEL-24937:
----------------------------------------
Summary: camel-pqc: confine FileBasedKeyLifecycleManager key file
resolution to the configured directory
Key: CAMEL-24937
URL: https://issues.apache.org/jira/browse/CAMEL-24937
Project: Camel
Issue Type: Improvement
Components: camel-pqc
Reporter: Andrea Cosentino
Assignee: Andrea Cosentino
FileBasedKeyLifecycleManager resolves key file paths from the keyId directly
under the configured key directory:
{code:java}
keyDirectory.resolve(keyId + ".private.json");
keyDirectory.resolve(keyId + ".public.json");
keyDirectory.resolve(keyId + ".metadata");
keyDirectory.resolve(keyId + ".key");
{code}
There is no validation that the resulting path stays within keyDirectory. A
keyId containing path separators, parent references ("..") or an absolute path
would resolve to a location outside the configured directory. keyId values flow
in from the CamelPQCKeyId / CamelPQCNewKeyId headers via the generateKeyPair /
rotateKey / getKeyMetadata / expireKey / revokeKey / deleteKeyState operations.
As defensive hardening, the manager should validate/confine keyId before using
it to build a path - e.g. reject separators, ".." and absolute paths, and/or
normalize the resolved path and verify it startsWith(keyDirectory) before any
read/write/delete - so all key-file operations stay inside the configured
directory regardless of the keyId value supplied by the route.
A shared helper could be applied consistently; the cloud-backed managers
(AwsSecretsManagerKeyLifecycleManager / AzureKeyVaultKeyLifecycleManager) build
provider-side names validated by the provider, so only the file-based manager
needs the filesystem confinement.
Add tests covering keyId values with "..", path separators and absolute paths,
asserting the operation is rejected (or safely confined) rather than touching a
file outside keyDirectory.
Affected: FileBasedKeyLifecycleManager in camel-pqc (main, 4.22.x, 4.18.x).
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
