[jira] [Created] (FELIX-6854) AbstractServlet.spoolResource delivers arbitrary files visible to classloader

["Konrad Windszus (Jira)" <ji...@apache.org>]

Konrad Windszus created FELIX-6854:
--------------------------------------

             Summary: AbstractServlet.spoolResource delivers arbitrary files visible to classloader
                 Key: FELIX-6854
                 URL: https://issues.apache.org/jira/browse/FELIX-6854
             Project: Felix
          Issue Type: Bug
          Components: Web Console
    Affects Versions: webconsole-5.0.18
            Reporter: Konrad Windszus


There is no limitation on resource names in https://github.com/apache/felix-dev/blob/762b769b60b41e139fce4a3c1b2c0bb1b2569155/webconsole/src/main/java/org/apache/felix/webconsole/servlet/AbstractServlet.java#L127 which allows to expose arbitrary class files via the Felix WebConsole. 

Only the underlying bundle classloader may limit visibility.
Although usually only admin like users have access to the Felix WebConsole, exposing all classloader resources unnecessarily may leak sensitive information.

Would be best if each web console plugin maintains an allow list which resources may be requested but this would probably require a non backwards compatible fix.

The same issue occurs in the deprecated AbstractWebConsolePlugin (https://github.com/apache/felix-dev/blob/762b769b60b41e139fce4a3c1b2c0bb1b2569155/webconsole/src/main/java/org/apache/felix/webconsole/AbstractWebConsolePlugin.java#L483).



--
This message was sent by Atlassian Jira
(v8.20.10#820010)