[
https://issues.apache.org/jira/browse/CAMEL-24438?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=18109084#comment-18109084
]
Claus Ibsen commented on CAMEL-24438:
-------------------------------------
However an idea I have could be to make this work in dev profile mode where it
does as now (can protect against outside project folder) and in prod profile
(not really intended to be used as you should use spring boot etc) then it can
be more restricted. And there can/should be an option to configure this in case
you really want to use this for prod, and not spring boot.
but its part of prototyping UX with camel jbang and should work easily there
(in dev profile mode)
> camel-platform-http-main - static file serving resolves against the process
> working directory and the classpath root
> --------------------------------------------------------------------------------------------------------------------
>
> Key: CAMEL-24438
> URL: https://issues.apache.org/jira/browse/CAMEL-24438
> Project: Camel
> Issue Type: Bug
> Components: camel-platform-http
> Reporter: Andrea Cosentino
> Assignee: Andrea Cosentino
> Priority: Major
> Fix For: 4.23.0
>
>
> {{MainHttpServer.setupStatic()}} mounts a catch-all route at
> {{staticContextPath}} + {{"*"}} (default {{"/"}}) and resolves the requested
> path like this:
> {code:java}
> String u = ctx.normalizedPath();
> ...
> File f = new File(u);
> if (!f.exists() && staticSourceDir != null) {
> f = new File(staticSourceDir, u);
> }
> if (f.exists()) {
> is = new FileInputStream(f);
> } else {
> is = camelContext.getClassResolver().loadResourceAsStream(u);
> if (is == null) {
> is =
> camelContext.getClassResolver().loadResourceAsStream("META-INF/resources/" +
> u);
> }
> ...
> }
> {code}
> {{new File(u)}} resolves relative to the process working directory, and it is
> tried *first*. {{staticSourceDir}} is only consulted when that misses, so it
> behaves as a fallback location rather than as a root the lookup is confined
> to. The classpath root is then tried as well. There is no extension allowlist
> and no denylist.
> camel-main and camel-jbang deployments conventionally keep
> {{application.properties}} in the working directory, and the route is
> registered at {{order(Integer.MAX_VALUE)}} so it answers anything no consumer
> matched. Vert.x path normalization does prevent {{../}} escapes, but the
> working directory and the classpath are already the roots being served.
> Proposal: make {{staticSourceDir}} an actual root - resolve every request
> under it and reject anything that escapes - and confine the classpath lookup
> to a dedicated prefix such as {{META-INF/resources/}} instead of the
> classpath root. Needs an upgrade-guide entry, since deployments relying on
> working-directory resolution would have to set {{staticSourceDir}}.
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
