This is an automated email from the ASF dual-hosted git repository.
Aias00 pushed a commit to branch master
in repository https://gitbox.apache.org/repos/asf/shenyu.git
The following commit(s) were added to refs/heads/master by this push:
new 1ecc77c511 [ISSUE 6334] : Add uri validation for regex and other
operators. (#6335)
1ecc77c511 is described below
commit 1ecc77c5117987d7bf775802e9dfb4586374fd6b
Author: hengyuss <[email protected]>
AuthorDate: Thu Jun 11 10:12:23 2026 +0800
[ISSUE 6334] : Add uri validation for regex and other operators. (#6335)
* fix admin : add uri validation for regex and other operators.
* fix admin : fix url condition and add test
* fix: add com.google.re2j dependency to resolve regex redos
* fix: fix UriConditionValidateorTest
---------
Co-authored-by: aias00 <[email protected]>
Co-authored-by: moremind <[email protected]>
---
pom.xml | 7 ++
shenyu-admin/pom.xml | 5 ++
.../apache/shenyu/admin/service/RuleService.java | 25 +++---
.../validator/UriConditionValidator.java | 71 ++++++++++++++++
.../validator/UriConditionValidatorTest.java | 99 ++++++++++++++++++++++
5 files changed, 192 insertions(+), 15 deletions(-)
diff --git a/pom.xml b/pom.xml
index be8c6d80e7..7fdbee3836 100644
--- a/pom.xml
+++ b/pom.xml
@@ -188,6 +188,7 @@
<spring-ai.version>1.1.2</spring-ai.version>
<mcp.version>0.17.0</mcp.version>
<swagger-parser.version>2.1.30</swagger-parser.version>
+ <re2j.version>1.8</re2j.version>
<!-- dependency version end -->
</properties>
@@ -590,6 +591,12 @@
<version>${swagger-parser.version}</version>
</dependency>
+ <dependency>
+ <groupId>com.google.re2j</groupId>
+ <artifactId>re2j</artifactId>
+ <version>${re2j.version}</version>
+ </dependency>
+
</dependencies>
</dependencyManagement>
diff --git a/shenyu-admin/pom.xml b/shenyu-admin/pom.xml
index 779ce46cb3..08f21c0b9e 100644
--- a/shenyu-admin/pom.xml
+++ b/shenyu-admin/pom.xml
@@ -357,6 +357,11 @@
<groupId>io.swagger.parser.v3</groupId>
<artifactId>swagger-parser</artifactId>
</dependency>
+
+ <dependency>
+ <groupId>com.google.re2j</groupId>
+ <artifactId>re2j</artifactId>
+ </dependency>
</dependencies>
<profiles>
diff --git
a/shenyu-admin/src/main/java/org/apache/shenyu/admin/service/RuleService.java
b/shenyu-admin/src/main/java/org/apache/shenyu/admin/service/RuleService.java
index 5c759f26e8..1993b87002 100644
---
a/shenyu-admin/src/main/java/org/apache/shenyu/admin/service/RuleService.java
+++
b/shenyu-admin/src/main/java/org/apache/shenyu/admin/service/RuleService.java
@@ -28,10 +28,9 @@ import
org.apache.shenyu.admin.model.query.RuleQueryCondition;
import org.apache.shenyu.admin.model.result.ConfigImportResult;
import org.apache.shenyu.admin.model.vo.RuleVO;
import org.apache.shenyu.admin.service.configs.ConfigsImportContext;
+import org.apache.shenyu.admin.validation.validator.UriConditionValidator;
import org.apache.shenyu.common.dto.RuleData;
-import org.apache.shenyu.common.enums.OperatorEnum;
import org.apache.shenyu.common.enums.ParamTypeEnum;
-import org.springframework.web.util.pattern.PathPatternParser;
import java.util.List;
@@ -55,17 +54,13 @@ public interface RuleService extends
PageService<RuleQueryCondition, RuleVO> {
* @return rows int
*/
default int createOrUpdate(final RuleDTO ruleDTO) {
-
- // now, only check rule uri condition in pathPattern mode
- // todo check uri in other modes
-
try {
final List<RuleConditionDTO> ruleConditions =
ruleDTO.getRuleConditions();
ruleConditions.stream()
.filter(conditionData ->
ParamTypeEnum.URI.getName().equals(conditionData.getParamType()))
- .filter(conditionData ->
OperatorEnum.PATH_PATTERN.getAlias().equals(conditionData.getOperator()))
- .map(RuleConditionDTO::getParamValue)
- .forEach(PathPatternParser.defaultInstance::parse);
+ .forEach(conditionData -> {
+
UriConditionValidator.validate(conditionData.getOperator(),
conditionData.getParamValue());
+ });
} catch (Exception e) {
throw new ShenyuAdminException("uri validation of Condition
failed, please check.", e);
}
@@ -91,7 +86,7 @@ public interface RuleService extends
PageService<RuleQueryCondition, RuleVO> {
/**
* delete rules by ids and namespaceId.
*
- * @param ids primary key.
+ * @param ids primary key.
* @param namespaceId namespaceId.
* @return rows int
*/
@@ -171,7 +166,7 @@ public interface RuleService extends
PageService<RuleQueryCondition, RuleVO> {
* Find by selector id and name rule do.
*
* @param selectorId selector id
- * @param name rule name
+ * @param name rule name
* @return {@link RuleDO}
*/
RuleDO findBySelectorIdAndName(String selectorId, String name);
@@ -188,8 +183,8 @@ public interface RuleService extends
PageService<RuleQueryCondition, RuleVO> {
* Import data.
*
* @param namespace namespace
- * @param ruleList rule list
- * @param context import context
+ * @param ruleList rule list
+ * @param context import context
* @return config import result
*/
ConfigImportResult importData(String namespace, List<RuleDTO> ruleList,
ConfigsImportContext context);
@@ -197,8 +192,8 @@ public interface RuleService extends
PageService<RuleQueryCondition, RuleVO> {
/**
* Enabled string by ids and namespaceId.
*
- * @param ids the ids
- * @param enabled the enabled
+ * @param ids the ids
+ * @param enabled the enabled
* @param namespaceId the namespaceId.
* @return the result
*/
diff --git
a/shenyu-admin/src/main/java/org/apache/shenyu/admin/validation/validator/UriConditionValidator.java
b/shenyu-admin/src/main/java/org/apache/shenyu/admin/validation/validator/UriConditionValidator.java
new file mode 100644
index 0000000000..e9dd952a0f
--- /dev/null
+++
b/shenyu-admin/src/main/java/org/apache/shenyu/admin/validation/validator/UriConditionValidator.java
@@ -0,0 +1,71 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one or more
+ * contributor license agreements. See the NOTICE file distributed with
+ * this work for additional information regarding copyright ownership.
+ * The ASF licenses this file to You under the Apache License, Version 2.0
+ * (the "License"); you may not use this file except in compliance with
+ * the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.apache.shenyu.admin.validation.validator;
+
+import com.google.re2j.Pattern;
+import org.apache.commons.lang3.StringUtils;
+import org.apache.shenyu.common.enums.OperatorEnum;
+import org.springframework.web.util.pattern.PathPatternParser;
+
+import java.util.HashMap;
+import java.util.Map;
+import java.util.Objects;
+import java.util.function.Consumer;
+
+public class UriConditionValidator {
+
+ private static final Map<String, Consumer<String>> VALIDATOR_MAP = new
HashMap<>();
+
+ static {
+ Consumer<String> commonPathValidator = value -> {
+ if (!value.startsWith("/")) {
+ throw new IllegalArgumentException("The URI must start with
'/'");
+ }
+ if (StringUtils.containsAny(value, " ", "\t", "\n")) {
+ throw new IllegalArgumentException(
+ "The URI cannot contain whitespaces. Current value: "
+ value);
+ }
+ };
+ Consumer<String> blankPathValidator = value -> {
+ if (StringUtils.isNotBlank(value)) {
+ throw new IllegalArgumentException("The URI must be blank");
+ }
+ };
+ VALIDATOR_MAP.put(OperatorEnum.PATH_PATTERN.getAlias(),
+ PathPatternParser.defaultInstance::parse);
+ VALIDATOR_MAP.put(OperatorEnum.REGEX.getAlias(), Pattern::compile);
+ VALIDATOR_MAP.put(OperatorEnum.EQ.getAlias(), commonPathValidator);
+ VALIDATOR_MAP.put(OperatorEnum.STARTS_WITH.getAlias(),
commonPathValidator);
+ VALIDATOR_MAP.put(OperatorEnum.ENDS_WITH.getAlias(),
commonPathValidator);
+ VALIDATOR_MAP.put(OperatorEnum.MATCH.getAlias(), commonPathValidator);
+ VALIDATOR_MAP.put(OperatorEnum.EXCLUDE.getAlias(),
commonPathValidator);
+ VALIDATOR_MAP.put(OperatorEnum.CONTAINS.getAlias(),
commonPathValidator);
+ VALIDATOR_MAP.put(OperatorEnum.IS_BLANK.getAlias(),
blankPathValidator);
+ }
+
+ public static void validate(final String operator, final String value) {
+ if (!OperatorEnum.IS_BLANK.getAlias().equals(operator) &&
StringUtils.isBlank(value)) {
+ throw new IllegalArgumentException("The URI condition value cannot
be empty.");
+ }
+ Consumer<String> validator = VALIDATOR_MAP.get(operator);
+ if (Objects.nonNull(validator)) {
+ validator.accept(value);
+ }
+ }
+
+}
diff --git
a/shenyu-admin/src/test/java/org/apache/shenyu/admin/validation/validator/UriConditionValidatorTest.java
b/shenyu-admin/src/test/java/org/apache/shenyu/admin/validation/validator/UriConditionValidatorTest.java
new file mode 100644
index 0000000000..29eb970d5f
--- /dev/null
+++
b/shenyu-admin/src/test/java/org/apache/shenyu/admin/validation/validator/UriConditionValidatorTest.java
@@ -0,0 +1,99 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one or more
+ * contributor license agreements. See the NOTICE file distributed with
+ * this work for additional information regarding copyright ownership.
+ * The ASF licenses this file to You under the Apache License, Version 2.0
+ * (the "License"); you may not use this file except in compliance with
+ * the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+package org.apache.shenyu.admin.validation.validator;
+
+import com.google.re2j.PatternSyntaxException;
+import org.apache.shenyu.common.enums.OperatorEnum;
+import org.junit.jupiter.api.Assertions;
+import org.junit.jupiter.api.Test;
+import org.springframework.web.util.pattern.PatternParseException;
+
+
+/**
+ * Test cases for {@link UriConditionValidator}.
+ */
+public class UriConditionValidatorTest {
+
+ @Test
+ public void testValidateErrorRegex() {
+ String pattern = "[abc";
+ Assertions.assertThrows(PatternSyntaxException.class,
+ () ->
UriConditionValidator.validate(OperatorEnum.REGEX.getAlias(), pattern));
+ }
+
+ @Test
+ public void testValidateHappyRegex() {
+ String pattern = "^\\/[a-zA-Z0-9\\-_\\/]+$";
+ Assertions.assertDoesNotThrow(() ->
UriConditionValidator.validate(OperatorEnum.REGEX.getAlias(), pattern));
+ }
+
+ @Test
+ public void testValidateHappyPathPattern() {
+ String pattern = "/http/**";
+ Assertions.assertDoesNotThrow(() ->
UriConditionValidator.validate(OperatorEnum.PATH_PATTERN.getAlias(), pattern));
+ }
+
+ @Test
+ public void testValidateErrorPathPattern() {
+ String pattern = "/http/{abc";
+ Assertions.assertThrows(PatternParseException.class,
+ () ->
UriConditionValidator.validate(OperatorEnum.PATH_PATTERN.getAlias(), pattern));
+ }
+
+ @Test
+ public void testValidateHappyIsBlank() {
+ String pattern = "";
+ Assertions.assertDoesNotThrow(() ->
UriConditionValidator.validate(OperatorEnum.IS_BLANK.getAlias(), pattern));
+ }
+
+ @Test
+ public void testValidateErrorIsBlank() {
+ String pattern = "/http";
+ Assertions.assertThrows(IllegalArgumentException.class,
+ () ->
UriConditionValidator.validate(OperatorEnum.IS_BLANK.getAlias(), pattern));
+ }
+
+ @Test
+ public void testValidateEmptyValueForNormalOperator() {
+ String pattern = " ";
+ Assertions.assertThrows(IllegalArgumentException.class,
+ () ->
UriConditionValidator.validate(OperatorEnum.EQ.getAlias(), pattern));
+ }
+
+ @Test
+ public void testValidateHappyOtherCondition() {
+ String pattern = "/http/test";
+ Assertions.assertDoesNotThrow(() ->
UriConditionValidator.validate(OperatorEnum.STARTS_WITH.getAlias(), pattern));
+ Assertions.assertDoesNotThrow(() ->
UriConditionValidator.validate(OperatorEnum.ENDS_WITH.getAlias(), pattern));
+ Assertions.assertDoesNotThrow(() ->
UriConditionValidator.validate(OperatorEnum.MATCH.getAlias(), pattern));
+ Assertions.assertDoesNotThrow(() ->
UriConditionValidator.validate(OperatorEnum.EQ.getAlias(), pattern));
+ Assertions.assertDoesNotThrow(() ->
UriConditionValidator.validate(OperatorEnum.EXCLUDE.getAlias(), pattern));
+ Assertions.assertDoesNotThrow(() ->
UriConditionValidator.validate(OperatorEnum.CONTAINS.getAlias(), pattern));
+ }
+
+ @Test
+ public void testValidateErrorOtherCondition() {
+ String pattern = "http/test";
+ Assertions.assertThrows(IllegalArgumentException.class, () ->
UriConditionValidator.validate(OperatorEnum.STARTS_WITH.getAlias(), pattern));
+ Assertions.assertThrows(IllegalArgumentException.class, () ->
UriConditionValidator.validate(OperatorEnum.ENDS_WITH.getAlias(), pattern));
+ Assertions.assertThrows(IllegalArgumentException.class, () ->
UriConditionValidator.validate(OperatorEnum.MATCH.getAlias(), pattern));
+ Assertions.assertThrows(IllegalArgumentException.class, () ->
UriConditionValidator.validate(OperatorEnum.EQ.getAlias(), pattern));
+ Assertions.assertThrows(IllegalArgumentException.class, () ->
UriConditionValidator.validate(OperatorEnum.EXCLUDE.getAlias(), pattern));
+ Assertions.assertThrows(IllegalArgumentException.class, () ->
UriConditionValidator.validate(OperatorEnum.CONTAINS.getAlias(), pattern));
+ }
+}
\ No newline at end of file
