zstan commented on code in PR #13382:
URL: https://github.com/apache/ignite/pull/13382#discussion_r3645383832
##########
modules/core/src/main/java/org/apache/ignite/internal/util/IgniteUtils.java:
##########
@@ -2558,10 +2566,71 @@ public static boolean mkdirs(File dir) {
public static URL resolveSpringUrl(String springCfgPath) throws
IgniteCheckedException {
A.notNull(springCfgPath, "springCfgPath");
+ String prop =
IgniteSystemProperties.IGNITE_ALLOW_REMOTE_SPRING_CFG_URL;
+
+ // Check always-blocked schemes against the raw string first, since
java.net.URL
+ // does not support ftp/ftps natively and throws MalformedURLException
before
+ // the scheme can be inspected, which would otherwise bypass this
check.
+ String lowerPath = springCfgPath.toLowerCase(Locale.ROOT);
+
+ for (String blockedScheme : ALWAYS_BLOCKED_CFG_SCHEMES) {
+ if (lowerPath.startsWith(blockedScheme + "://"))
+ throw new IgniteCheckedException(
+ "Spring configuration URLs with scheme '" + blockedScheme
+ "' are always blocked " +
+ "due to security risk. Use a local file/classpath
reference instead. " +
+ "For remote HTTP/HTTPS set system property: -D" +
+ prop + "=true."
+ );
+ }
+
URL url;
try {
url = new URL(springCfgPath);
+
+ URL cfgUrl = url;
+
+ String scheme = cfgUrl.getProtocol().toLowerCase(Locale.ROOT);
+
+ // Unwrap jar:<nested_url>!/path (potentially nested) to avoid
bypassing remote-scheme checks.
+ while ("jar".equals(scheme)) {
+ String file = cfgUrl.getFile();
+
+ int sep = file.indexOf("!/");
+
+ if (sep <= 0)
+ break;
+
+ try {
+ cfgUrl = new URL(file.substring(0, sep));
+ scheme = cfgUrl.getProtocol().toLowerCase(Locale.ROOT);
+ }
+ catch (MalformedURLException ignored) {
+ break;
+ }
+ }
+
+ if (REMOTE_CFG_SCHEMES.contains(scheme)) {
+ if (ALWAYS_BLOCKED_CFG_SCHEMES.contains(scheme))
+ throw new IgniteCheckedException(
+ "Spring configuration URLs with scheme '" + scheme +
"' are always blocked " +
+ "due to security risk. Use a local file/classpath
reference instead. " +
+ "For remote HTTP/HTTPS set system property: -D" +
+ prop + "=true. " +
+ "Provided host: " + cfgUrl.getHost()
+ );
+
+ boolean allowRemote = IgniteSystemProperties.getBoolean(prop);
+
+ if (!allowRemote)
+ throw new IgniteCheckedException(
+ "Remote Spring configuration URLs (http/https) are not
allowed by default " +
+ "to prevent remote code execution via
attacker-controlled Spring XML. " +
+ "Provided host: " + cfgUrl.getHost() + ". " +
+ "To allow remote URLs set system property: -D" +
Review Comment:
```suggestion
"To allow remote URL`s set system property: -D" +
```
##########
modules/core/src/main/java/org/apache/ignite/internal/util/IgniteUtils.java:
##########
@@ -2558,10 +2566,71 @@ public static boolean mkdirs(File dir) {
public static URL resolveSpringUrl(String springCfgPath) throws
IgniteCheckedException {
A.notNull(springCfgPath, "springCfgPath");
+ String prop =
IgniteSystemProperties.IGNITE_ALLOW_REMOTE_SPRING_CFG_URL;
+
+ // Check always-blocked schemes against the raw string first, since
java.net.URL
+ // does not support ftp/ftps natively and throws MalformedURLException
before
+ // the scheme can be inspected, which would otherwise bypass this
check.
+ String lowerPath = springCfgPath.toLowerCase(Locale.ROOT);
+
+ for (String blockedScheme : ALWAYS_BLOCKED_CFG_SCHEMES) {
+ if (lowerPath.startsWith(blockedScheme + "://"))
+ throw new IgniteCheckedException(
+ "Spring configuration URLs with scheme '" + blockedScheme
+ "' are always blocked " +
+ "due to security risk. Use a local file/classpath
reference instead. " +
+ "For remote HTTP/HTTPS set system property: -D" +
+ prop + "=true."
+ );
+ }
+
URL url;
try {
url = new URL(springCfgPath);
+
+ URL cfgUrl = url;
+
+ String scheme = cfgUrl.getProtocol().toLowerCase(Locale.ROOT);
+
+ // Unwrap jar:<nested_url>!/path (potentially nested) to avoid
bypassing remote-scheme checks.
+ while ("jar".equals(scheme)) {
+ String file = cfgUrl.getFile();
+
+ int sep = file.indexOf("!/");
+
+ if (sep <= 0)
+ break;
+
+ try {
+ cfgUrl = new URL(file.substring(0, sep));
+ scheme = cfgUrl.getProtocol().toLowerCase(Locale.ROOT);
+ }
+ catch (MalformedURLException ignored) {
+ break;
+ }
+ }
+
+ if (REMOTE_CFG_SCHEMES.contains(scheme)) {
+ if (ALWAYS_BLOCKED_CFG_SCHEMES.contains(scheme))
+ throw new IgniteCheckedException(
+ "Spring configuration URLs with scheme '" + scheme +
"' are always blocked " +
+ "due to security risk. Use a local file/classpath
reference instead. " +
+ "For remote HTTP/HTTPS set system property: -D" +
Review Comment:
here and elsewhere "HTTP, HTTPS" or "HTTP|HTTPS"
##########
modules/clients/src/test/java/org/apache/ignite/internal/jdbc2/JdbcConnectionSelfTest.java:
##########
@@ -39,7 +42,9 @@ public class JdbcConnectionSelfTest extends
GridCommonAbstractTest {
/** Custom cache name. */
private static final String CUSTOM_CACHE_NAME = "custom-cache";
- /** Grid count. */
+ /**
+ * Grid count.
Review Comment:
plz revert this and below changes too
##########
modules/core/src/main/java/org/apache/ignite/internal/util/IgniteUtils.java:
##########
@@ -2558,10 +2566,71 @@ public static boolean mkdirs(File dir) {
public static URL resolveSpringUrl(String springCfgPath) throws
IgniteCheckedException {
A.notNull(springCfgPath, "springCfgPath");
+ String prop =
IgniteSystemProperties.IGNITE_ALLOW_REMOTE_SPRING_CFG_URL;
+
+ // Check always-blocked schemes against the raw string first, since
java.net.URL
+ // does not support ftp/ftps natively and throws MalformedURLException
before
+ // the scheme can be inspected, which would otherwise bypass this
check.
+ String lowerPath = springCfgPath.toLowerCase(Locale.ROOT);
+
+ for (String blockedScheme : ALWAYS_BLOCKED_CFG_SCHEMES) {
Review Comment:
why we have two check places ? here and a bit lower ? i comment this check
and only one test failed due to different error message
##########
modules/core/src/main/java/org/apache/ignite/internal/util/IgniteUtils.java:
##########
@@ -2558,10 +2566,71 @@ public static boolean mkdirs(File dir) {
public static URL resolveSpringUrl(String springCfgPath) throws
IgniteCheckedException {
A.notNull(springCfgPath, "springCfgPath");
+ String prop =
IgniteSystemProperties.IGNITE_ALLOW_REMOTE_SPRING_CFG_URL;
+
+ // Check always-blocked schemes against the raw string first, since
java.net.URL
+ // does not support ftp/ftps natively and throws MalformedURLException
before
+ // the scheme can be inspected, which would otherwise bypass this
check.
+ String lowerPath = springCfgPath.toLowerCase(Locale.ROOT);
+
+ for (String blockedScheme : ALWAYS_BLOCKED_CFG_SCHEMES) {
+ if (lowerPath.startsWith(blockedScheme + "://"))
+ throw new IgniteCheckedException(
+ "Spring configuration URLs with scheme '" + blockedScheme
+ "' are always blocked " +
+ "due to security risk. Use a local file/classpath
reference instead. " +
+ "For remote HTTP/HTTPS set system property: -D" +
+ prop + "=true."
+ );
+ }
+
URL url;
try {
url = new URL(springCfgPath);
+
+ URL cfgUrl = url;
+
+ String scheme = cfgUrl.getProtocol().toLowerCase(Locale.ROOT);
+
+ // Unwrap jar:<nested_url>!/path (potentially nested) to avoid
bypassing remote-scheme checks.
+ while ("jar".equals(scheme)) {
+ String file = cfgUrl.getFile();
+
+ int sep = file.indexOf("!/");
+
+ if (sep <= 0)
+ break;
+
+ try {
+ cfgUrl = new URL(file.substring(0, sep));
+ scheme = cfgUrl.getProtocol().toLowerCase(Locale.ROOT);
+ }
+ catch (MalformedURLException ignored) {
+ break;
+ }
+ }
+
+ if (REMOTE_CFG_SCHEMES.contains(scheme)) {
+ if (ALWAYS_BLOCKED_CFG_SCHEMES.contains(scheme))
+ throw new IgniteCheckedException(
+ "Spring configuration URLs with scheme '" + scheme +
"' are always blocked " +
+ "due to security risk. Use a local file/classpath
reference instead. " +
+ "For remote HTTP/HTTPS set system property: -D" +
+ prop + "=true. " +
+ "Provided host: " + cfgUrl.getHost()
+ );
+
+ boolean allowRemote = IgniteSystemProperties.getBoolean(prop);
+
+ if (!allowRemote)
+ throw new IgniteCheckedException(
+ "Remote Spring configuration URLs (http/https) are not
allowed by default " +
Review Comment:
```suggestion
"Remote Spring configuration URL`s (http/https) are
not allowed by default " +
```
##########
modules/core/src/main/java/org/apache/ignite/internal/util/IgniteUtils.java:
##########
@@ -2558,10 +2566,71 @@ public static boolean mkdirs(File dir) {
public static URL resolveSpringUrl(String springCfgPath) throws
IgniteCheckedException {
A.notNull(springCfgPath, "springCfgPath");
+ String prop =
IgniteSystemProperties.IGNITE_ALLOW_REMOTE_SPRING_CFG_URL;
+
+ // Check always-blocked schemes against the raw string first, since
java.net.URL
+ // does not support ftp/ftps natively and throws MalformedURLException
before
+ // the scheme can be inspected, which would otherwise bypass this
check.
+ String lowerPath = springCfgPath.toLowerCase(Locale.ROOT);
+
+ for (String blockedScheme : ALWAYS_BLOCKED_CFG_SCHEMES) {
+ if (lowerPath.startsWith(blockedScheme + "://"))
+ throw new IgniteCheckedException(
+ "Spring configuration URLs with scheme '" + blockedScheme
+ "' are always blocked " +
+ "due to security risk. Use a local file/classpath
reference instead. " +
+ "For remote HTTP/HTTPS set system property: -D" +
+ prop + "=true."
+ );
+ }
+
URL url;
try {
url = new URL(springCfgPath);
+
+ URL cfgUrl = url;
+
+ String scheme = cfgUrl.getProtocol().toLowerCase(Locale.ROOT);
+
+ // Unwrap jar:<nested_url>!/path (potentially nested) to avoid
bypassing remote-scheme checks.
+ while ("jar".equals(scheme)) {
+ String file = cfgUrl.getFile();
+
+ int sep = file.indexOf("!/");
+
+ if (sep <= 0)
+ break;
+
+ try {
+ cfgUrl = new URL(file.substring(0, sep));
+ scheme = cfgUrl.getProtocol().toLowerCase(Locale.ROOT);
+ }
+ catch (MalformedURLException ignored) {
+ break;
+ }
+ }
+
+ if (REMOTE_CFG_SCHEMES.contains(scheme)) {
+ if (ALWAYS_BLOCKED_CFG_SCHEMES.contains(scheme))
+ throw new IgniteCheckedException(
+ "Spring configuration URLs with scheme '" + scheme +
"' are always blocked " +
Review Comment:
```suggestion
"Spring configuration URL`s with scheme '" + scheme
+ "' are always blocked " +
```
##########
modules/core/src/main/java/org/apache/ignite/internal/util/IgniteUtils.java:
##########
@@ -2558,10 +2566,71 @@ public static boolean mkdirs(File dir) {
public static URL resolveSpringUrl(String springCfgPath) throws
IgniteCheckedException {
A.notNull(springCfgPath, "springCfgPath");
+ String prop =
IgniteSystemProperties.IGNITE_ALLOW_REMOTE_SPRING_CFG_URL;
+
+ // Check always-blocked schemes against the raw string first, since
java.net.URL
+ // does not support ftp/ftps natively and throws MalformedURLException
before
+ // the scheme can be inspected, which would otherwise bypass this
check.
+ String lowerPath = springCfgPath.toLowerCase(Locale.ROOT);
+
+ for (String blockedScheme : ALWAYS_BLOCKED_CFG_SCHEMES) {
+ if (lowerPath.startsWith(blockedScheme + "://"))
+ throw new IgniteCheckedException(
+ "Spring configuration URLs with scheme '" + blockedScheme
+ "' are always blocked " +
+ "due to security risk. Use a local file/classpath
reference instead. " +
+ "For remote HTTP/HTTPS set system property: -D" +
+ prop + "=true."
+ );
+ }
+
URL url;
try {
url = new URL(springCfgPath);
+
+ URL cfgUrl = url;
+
+ String scheme = cfgUrl.getProtocol().toLowerCase(Locale.ROOT);
+
+ // Unwrap jar:<nested_url>!/path (potentially nested) to avoid
bypassing remote-scheme checks.
+ while ("jar".equals(scheme)) {
+ String file = cfgUrl.getFile();
+
+ int sep = file.indexOf("!/");
+
+ if (sep <= 0)
+ break;
+
+ try {
+ cfgUrl = new URL(file.substring(0, sep));
+ scheme = cfgUrl.getProtocol().toLowerCase(Locale.ROOT);
+ }
+ catch (MalformedURLException ignored) {
+ break;
+ }
+ }
+
+ if (REMOTE_CFG_SCHEMES.contains(scheme)) {
+ if (ALWAYS_BLOCKED_CFG_SCHEMES.contains(scheme))
+ throw new IgniteCheckedException(
+ "Spring configuration URLs with scheme '" + scheme +
"' are always blocked " +
+ "due to security risk. Use a local file/classpath
reference instead. " +
Review Comment:
```suggestion
"due to security risk. Use a local file or classpath
reference instead. " +
```
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
