You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@solr.apache.org by ds...@apache.org on 2026/08/08 04:19:51 UTC
(solr) 03/14: PKIAuthenticationPlugin: handle non-base64 SolrAuthV2 signature (#4553)
This is an automated email from the ASF dual-hosted git repository.
dsmiley pushed a commit to branch branch_10x
in repository https://gitbox.apache.org/repos/asf/solr.git
commit 5e8c46a7c4ef94b7e27ca59413501fefc23f586a
Author: Jan Høydahl <ja...@apache.org>
AuthorDate: Wed Aug 5 11:43:13 2026 +0200
PKIAuthenticationPlugin: handle non-base64 SolrAuthV2 signature (#4553)
(cherry picked from commit d9e1468dda4d00f20e211e51a69c095bc3be5457)
---
.../unreleased/PR#4553-pki-v2-header-base64-fix.yml | 7 +++++++
.../apache/solr/security/PKIAuthenticationPlugin.java | 8 +++++++-
.../solr/security/TestPKIAuthenticationPlugin.java | 17 +++++++++++++++++
3 files changed, 31 insertions(+), 1 deletion(-)
diff --git a/changelog/unreleased/PR#4553-pki-v2-header-base64-fix.yml b/changelog/unreleased/PR#4553-pki-v2-header-base64-fix.yml
new file mode 100644
index 00000000000..9e503d01e70
--- /dev/null
+++ b/changelog/unreleased/PR#4553-pki-v2-header-base64-fix.yml
@@ -0,0 +1,7 @@
+title: PKIAuthenticationPlugin now rejects a SolrAuthV2 header with a malformed signature using a 401 response, instead of returning a 500
+type: fixed
+authors:
+ - name: Jan Høydahl
+links:
+ - name: PR#4553
+ url: https://github.com/apache/solr/pull/4553
diff --git a/solr/core/src/java/org/apache/solr/security/PKIAuthenticationPlugin.java b/solr/core/src/java/org/apache/solr/security/PKIAuthenticationPlugin.java
index 7c2eb80c28b..aef49c122ff 100644
--- a/solr/core/src/java/org/apache/solr/security/PKIAuthenticationPlugin.java
+++ b/solr/core/src/java/org/apache/solr/security/PKIAuthenticationPlugin.java
@@ -209,7 +209,13 @@ public class PKIAuthenticationPlugin extends AuthenticationPlugin
int sigStart = header.lastIndexOf(' ');
String data = header.substring(0, sigStart);
- byte[] sig = Base64.getDecoder().decode(header.substring(sigStart + 1));
+ byte[] sig;
+ try {
+ sig = Base64.getDecoder().decode(header.substring(sigStart + 1));
+ } catch (IllegalArgumentException e) {
+ log.warn("Could not parse signature in SolrAuthV2 header as base64");
+ return null;
+ }
PKIHeaderData rv = validateSignature(data, sig, key, false);
if (rv == null) {
log.warn("Failed to verify signature, trying after refreshing the key ");
diff --git a/solr/core/src/test/org/apache/solr/security/TestPKIAuthenticationPlugin.java b/solr/core/src/test/org/apache/solr/security/TestPKIAuthenticationPlugin.java
index cff82ba6e7a..b19750cb564 100644
--- a/solr/core/src/test/org/apache/solr/security/TestPKIAuthenticationPlugin.java
+++ b/solr/core/src/test/org/apache/solr/security/TestPKIAuthenticationPlugin.java
@@ -207,6 +207,23 @@ public class TestPKIAuthenticationPlugin extends SolrTestCaseJ4 {
"Should not have proceeded after authentication failure", wrappedRequestByFilter.get());
}
+ @Test
+ public void testMalformedV2HeaderSignatureRejected() throws Exception {
+ headerValue.set(nodeName + " someuser 1234567890 not_base64!!!");
+
+ HttpServletResponse response = mock(HttpServletResponse.class);
+ assertFalse(
+ "Should have rejected request with a non-base64 signature",
+ mock.authenticate(mockReq, response, filterChain));
+
+ verify(response)
+ .setHeader(HttpHeader.WWW_AUTHENTICATE.asString(), PKIAuthenticationPlugin.HEADER_V2);
+ verify(response).sendError(ArgumentMatchers.eq(401), anyString());
+
+ assertNull(
+ "Should not have proceeded after authentication failure", wrappedRequestByFilter.get());
+ }
+
private HttpServletRequest createMockRequest(final AtomicReference<String> headerValue) {
HttpServletRequest mockReq = mock(HttpServletRequest.class);
when(mockReq.getHeader(any(String.class)))