pjfanning opened a new pull request, #1875:
URL: https://github.com/apache/pekko-connectors/pull/1875
**Motivation:**
`IronMqClient` built every request path by interpolating the queue name into
a string and handing the result to `Uri(...)`:
```scala
makeRequest(Post(Uri(s"$queuesPath/${queueName}/messages"), payload))
```
`Uri` parses that string as URI *syntax*, so characters in the queue name
are not treated as data. Probing the actual parse with `base =
"/3/projects/PID/queues"`:
```
normal -> path=/3/projects/PID/queues/normal/messages
a/../../admin -> path=/3/projects/PID/queues/a/../../admin/messages
a?x=1 -> path=/3/projects/PID/queues/a query=Some(x=1/messages)
a#frag -> path=/3/projects/PID/queues/a fragment=Some(frag/messages)
a b -> IllegalUriException
```
A queue name can therefore add path segments, truncate the path and inject a
query string, or make an otherwise valid name throw. `queueName` reaches this
straight from the public API — `IronMqConsumer.atMostOnceSource`,
`IronMqConsumer.atLeastOnceSource`,
`IronMqProducer.flow`/`sink`/`atLeastOnceFlow` — and nothing validates it on
the way.
**Modification:**
Build the path with `Uri.Path` segments, which escape each segment, via a
`queuePath`/`queueUri` helper used by all eleven call sites. `projectId`
becomes a segment too. `queuePath` is `private[impl]` so the escaping can be
tested without a live server.
One inconsistency fixed in passing: the touch endpoint interpolated
`${reservation.messageId}` where the release endpoint used `.value`; both now
pass `.value`. `Message.Id` overrides `toString` to return `value`, so this is
a no-op — just consistent.
**Result:**
A queue name containing `/`, `?`, `#` or `..` is escaped and cannot alter
the request target. Names containing spaces now work instead of throwing
`IllegalUriException`.
**Tests:**
Added `IronMqClientPathSpec`, which needs no IronMQ server — it exercises
path construction only. It asserts the path for a normal name, that `/`, `?`
and `#` are escaped and produce no query or fragment, that a name with a space
is accepted, and that a range of hostile names all stay under the queues path.
6 tests pass.
Ran `ironmq/mimaReportBinaryIssues` (clean) and the module scalafmt checks.
**References:**
Found while auditing for injection issues after #1817 and #1821.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
