mattcasters opened a new pull request, #8889: URL: https://github.com/apache/hop/pull/8889
`HopServerAuthorizationFilter` authorized the raw request URI and called the filter chain when that string did not start with `/hop`. Tomcat normalizes `//`, `/./` and `/../` before it matches the `/hop/*` filter and servlet, then `HopServerServlet` dispatches `getPathInfo()`. A request such as `//hop/execPipeline` reached the servlet without the mode-`NONE` deny or the per-endpoint role check. `/hop/status/../execPipeline` was classified as `/hop/status`, so a read-only user was allowed while the servlet ran `execPipeline`. The filter now authorizes `getServletPath()` + `getPathInfo()` and denies a missing or non-`/hop` mapping. The permission mapper strips matrix parameters per segment and resolves `.` and `..` before the prefix match. fixes #8888 ------------------------ Thank you for your contribution! Follow this checklist to help us incorporate your contribution quickly and easily: - [ ] Run `mvn clean install apache-rat:check` to make sure basic checks pass. A more thorough check will be performed on your pull request automatically. - [x] If you have a group of commits related to the same change, please squash your commits into one and force push your branch using `git rebase -i`. - [x] Mention the appropriate issue in your description (for example: `addresses #123`), if applicable. To make clear that you license your contribution under the [Apache License Version 2.0, January 2004](http://www.apache.org/licenses/LICENSE-2.0) you have to acknowledge this by using the following check-box. - [x] I hereby declare this contribution to be licensed under the [Apache License Version 2.0, January 2004](http://www.apache.org/licenses/LICENSE-2.0) - [ ] In any other case, please file an [Apache Individual Contributor License Agreement](https://www.apache.org/licenses/icla.pdf). -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
