[
https://issues.apache.org/jira/browse/CAMEL-24438?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=18109082#comment-18109082
]
Claus Ibsen commented on CAMEL-24438:
-------------------------------------
But surely if a path goes outside the project folder then that can be fixed,
but loading resources from classpath is per design!
> camel-platform-http-main - static file serving resolves against the process
> working directory and the classpath root
> --------------------------------------------------------------------------------------------------------------------
>
> Key: CAMEL-24438
> URL: https://issues.apache.org/jira/browse/CAMEL-24438
> Project: Camel
> Issue Type: Bug
> Components: camel-platform-http
> Reporter: Andrea Cosentino
> Assignee: Andrea Cosentino
> Priority: Major
> Fix For: 4.23.0
>
>
> {{MainHttpServer.setupStatic()}} mounts a catch-all route at
> {{staticContextPath}} + {{"*"}} (default {{"/"}}) and resolves the requested
> path like this:
> {code:java}
> String u = ctx.normalizedPath();
> ...
> File f = new File(u);
> if (!f.exists() && staticSourceDir != null) {
> f = new File(staticSourceDir, u);
> }
> if (f.exists()) {
> is = new FileInputStream(f);
> } else {
> is = camelContext.getClassResolver().loadResourceAsStream(u);
> if (is == null) {
> is =
> camelContext.getClassResolver().loadResourceAsStream("META-INF/resources/" +
> u);
> }
> ...
> }
> {code}
> {{new File(u)}} resolves relative to the process working directory, and it is
> tried *first*. {{staticSourceDir}} is only consulted when that misses, so it
> behaves as a fallback location rather than as a root the lookup is confined
> to. The classpath root is then tried as well. There is no extension allowlist
> and no denylist.
> camel-main and camel-jbang deployments conventionally keep
> {{application.properties}} in the working directory, and the route is
> registered at {{order(Integer.MAX_VALUE)}} so it answers anything no consumer
> matched. Vert.x path normalization does prevent {{../}} escapes, but the
> working directory and the classpath are already the roots being served.
> Proposal: make {{staticSourceDir}} an actual root - resolve every request
> under it and reject anything that escapes - and confine the classpath lookup
> to a dedicated prefix such as {{META-INF/resources/}} instead of the
> classpath root. Needs an upgrade-guide entry, since deployments relying on
> working-directory resolution would have to set {{staticSourceDir}}.
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
