[jira] [Assigned] (TIKA-4826) MimeTypes.forName interns unknown media types into an unbounded map (slow memory growth on untrusted-input paths)

["Tim Allison (Jira)" <ji...@apache.org>]

     [ https://issues.apache.org/jira/browse/TIKA-4826?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ]

Tim Allison reassigned TIKA-4826:
---------------------------------

    Assignee: Tim Allison

> MimeTypes.forName interns unknown media types into an unbounded map (slow memory growth on untrusted-input paths)
> -----------------------------------------------------------------------------------------------------------------
>
>                 Key: TIKA-4826
>                 URL: https://issues.apache.org/jira/browse/TIKA-4826
>             Project: Tika
>          Issue Type: Bug
>            Reporter: Dominik Schmidt
>            Assignee: Tim Allison
>            Priority: Major
>
> MimeTypes.forName(String) (tika-core, MimeTypes.java:351) is called during content detection to turn a type hint into a MimeType: MimeTypes.detect runs applyHint, which calls forName(typeName) for the caller's Content-Type. For a syntactically valid but unknown type, forName creates a new MimeType and registers it via add(mime) / types.put(...) into an internal map that is never bounded or evicted (lines 359-369).
> A caller that can influence the type string reaching detection can therefore drive slow, unbounded memory growth by sending a stream of unique, syntactically-valid, unknown media types (for example application/x-<random>). This is reachable today from the tika-server request Content-Type on the direct endpoints, and TIKA-4825 adds the tika-pipes FetchEmitTuple path as another route to the same lookup.
> Severity is low (it needs many requests with distinct crafted types, and growth is slow), but it is an avoidable footgun on an untrusted-input path, and it is a shared/static registry so growth persists for the JVM lifetime.
> Proposed fix: use a non-registering lookup in the detection path. applyHint only needs to know whether the hinted type equals or specializes a known type; it does not need to intern unknown types. Either add a MimeTypes.detect/applyHint variant that resolves a hint against the existing registry without adding, or bound/evict the registration map.
> Note: discovered during review of TIKA-4825 (apache/tika#3039); flagged there as pre-existing and out of scope for that PR.



--
This message was sent by Atlassian Jira
(v8.20.10#820010)