You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@tika.apache.org by ta...@apache.org on 2026/02/01 13:34:35 UTC

(tika) branch TIKA-4644-improve-config-endpoints created (now a9bc1f152c)

This is an automated email from the ASF dual-hosted git repository.

tallison pushed a change to branch TIKA-4644-improve-config-endpoints
in repository https://gitbox.apache.org/repos/asf/tika.git


      at a9bc1f152c TIKA-4644 - improve config endpoints

This branch includes the following new commits:

     new a9bc1f152c TIKA-4644 - improve config endpoints

The 1 revisions listed above as "new" are entirely new to this
repository and will be described in separate emails.  The revisions
listed as "add" were already present in the repository and have only
been added to this reference.



(tika) 01/01: TIKA-4644 - improve config endpoints

Posted by ta...@apache.org.
This is an automated email from the ASF dual-hosted git repository.

tallison pushed a commit to branch TIKA-4644-improve-config-endpoints
in repository https://gitbox.apache.org/repos/asf/tika.git

commit a9bc1f152c686034bc05f2772d0aaf8360600ff6
Author: tallison <ta...@apache.org>
AuthorDate: Sun Feb 1 08:27:27 2026 -0500

    TIKA-4644 - improve config endpoints
---
 .../server/core/ConfigEndpointSecurityFilter.java  |  48 +++++++
 .../apache/tika/server/core/TikaServerConfig.java  |  11 +-
 .../apache/tika/server/core/TikaServerProcess.java |   3 +
 .../tika/server/core/resource/TikaResource.java    |  26 +++-
 .../core/ConfigEndpointSecurityEnabledTest.java    | 111 ++++++++++++++++
 .../server/core/ConfigEndpointSecurityTest.java    | 143 +++++++++++++++++++++
 .../tika/server/standard/TikaResourceTest.java     |  26 ++--
 7 files changed, 347 insertions(+), 21 deletions(-)

diff --git a/tika-server/tika-server-core/src/main/java/org/apache/tika/server/core/ConfigEndpointSecurityFilter.java b/tika-server/tika-server-core/src/main/java/org/apache/tika/server/core/ConfigEndpointSecurityFilter.java
new file mode 100644
index 0000000000..16787e441b
--- /dev/null
+++ b/tika-server/tika-server-core/src/main/java/org/apache/tika/server/core/ConfigEndpointSecurityFilter.java
@@ -0,0 +1,48 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one or more
+ * contributor license agreements.  See the NOTICE file distributed with
+ * this work for additional information regarding copyright ownership.
+ * The ASF licenses this file to You under the Apache License, Version 2.0
+ * (the "License"); you may not use this file except in compliance with
+ * the License.  You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.apache.tika.server.core;
+
+import jakarta.ws.rs.container.ContainerRequestContext;
+import jakarta.ws.rs.container.ContainerRequestFilter;
+import jakarta.ws.rs.core.MediaType;
+import jakarta.ws.rs.core.Response;
+import jakarta.ws.rs.ext.Provider;
+
+/**
+ * JAX-RS filter that gates /config endpoints behind the enableUnsecureFeatures flag.
+ * When enableUnsecureFeatures is false, requests to paths containing "/config" will
+ * receive a 403 Forbidden response.
+ */
+@Provider
+public class ConfigEndpointSecurityFilter implements ContainerRequestFilter {
+
+    private final boolean enableUnsecureFeatures;
+
+    public ConfigEndpointSecurityFilter(boolean enableUnsecureFeatures) {
+        this.enableUnsecureFeatures = enableUnsecureFeatures;
+    }
+
+    @Override
+    public void filter(ContainerRequestContext requestContext) {
+        if (!enableUnsecureFeatures && requestContext.getUriInfo().getPath().contains("/config")) {
+            requestContext.abortWith(Response.status(Response.Status.FORBIDDEN)
+                    .entity("Config endpoints are disabled. Set enableUnsecureFeatures=true in server config.")
+                    .type(MediaType.TEXT_PLAIN)
+                    .build());
+        }
+    }
+}
diff --git a/tika-server/tika-server-core/src/main/java/org/apache/tika/server/core/TikaServerConfig.java b/tika-server/tika-server-core/src/main/java/org/apache/tika/server/core/TikaServerConfig.java
index 698f95500f..fa7bb3f93d 100644
--- a/tika-server/tika-server-core/src/main/java/org/apache/tika/server/core/TikaServerConfig.java
+++ b/tika-server/tika-server-core/src/main/java/org/apache/tika/server/core/TikaServerConfig.java
@@ -49,9 +49,14 @@ public class TikaServerConfig {
     private static final long DEFAULT_MAX_FILES = 100000;
     private static final int DEFAULT_DIGEST_MARK_LIMIT = 20 * 1024 * 1024;
     private static final String UNSECURE_WARNING =
-            "WARNING: You have chosen to run tika-server with unsecure features enabled.\n" + "Whoever has access to your service now has the same read permissions\n" +
-                    "as you've given your fetchers and the same write permissions " + "as your emitters.\n" + "Users could request and receive a sensitive file from your\n" +
-                    "drive or a webpage from your intranet and/or send malicious content to\n" + " your emitter endpoints.  See CVE-2015-3271.\n" +
+            "WARNING: You have chosen to run tika-server with unsecure features enabled.\n" +
+                    "Whoever has access to your service now has the same read permissions\n" +
+                    "as you've given your fetchers and the same write permissions as your emitters.\n" +
+                    "Users could request and receive a sensitive file from your\n" +
+                    "drive or a webpage from your intranet and/or send malicious content to\n" +
+                    "your emitter endpoints. See CVE-2015-3271.\n" +
+                    "Additionally, /config endpoints allow per-request parser configuration\n" +
+                    "which could enable dangerous operations.\n" +
                     "Please make sure you know what you are doing.";
     private static final List<String> ONLY_IN_FORK_MODE = Arrays.asList(
             new String[]{"maxFiles", "javaPath", "maxRestarts", "numRestarts", "forkedStatusFile", "maxForkedStartupMillis",
diff --git a/tika-server/tika-server-core/src/main/java/org/apache/tika/server/core/TikaServerProcess.java b/tika-server/tika-server-core/src/main/java/org/apache/tika/server/core/TikaServerProcess.java
index 23e44852ea..725fd91d1d 100644
--- a/tika-server/tika-server-core/src/main/java/org/apache/tika/server/core/TikaServerProcess.java
+++ b/tika-server/tika-server-core/src/main/java/org/apache/tika/server/core/TikaServerProcess.java
@@ -297,6 +297,9 @@ public class TikaServerProcess {
         writers.add(new TikaServerParseExceptionMapper(tikaServerConfig.isReturnStackTrace()));
         writers.add(new JSONObjWriter());
 
+        // Add ConfigEndpointSecurityFilter to gate /config endpoints
+        writers.add(new ConfigEndpointSecurityFilter(tikaServerConfig.isEnableUnsecureFeatures()));
+
         TikaLoggingFilter logFilter = null;
         if (!StringUtils.isBlank(tikaServerConfig.getLogLevel())) {
             String logLevel = tikaServerConfig.getLogLevel();
diff --git a/tika-server/tika-server-core/src/main/java/org/apache/tika/server/core/resource/TikaResource.java b/tika-server/tika-server-core/src/main/java/org/apache/tika/server/core/resource/TikaResource.java
index 57c2d76d92..5819ccb551 100644
--- a/tika-server/tika-server-core/src/main/java/org/apache/tika/server/core/resource/TikaResource.java
+++ b/tika-server/tika-server-core/src/main/java/org/apache/tika/server/core/resource/TikaResource.java
@@ -591,11 +591,15 @@ public class TikaResource {
      * - "file" part (required): the document to parse
      * - "config" part (optional): JSON configuration for parser settings and handler type
      * <p>
-     * Returns XHTML by default. Use /tika/text, /tika/html, or /tika/xml for other formats.
+     * Returns XHTML by default. Use /tika/config/text, /tika/config/html, or /tika/config/xml for other formats.
+     * <p>
+     * This endpoint is gated behind enableUnsecureFeatures=true because per-request
+     * configuration could enable dangerous operations.
      */
     @POST
     @Consumes("multipart/form-data")
     @Produces("text/xml")
+    @Path("config")
     public StreamingOutput postRaw(List<Attachment> attachments, @Context HttpHeaders httpHeaders)
             throws IOException {
         ParseContext context = createParseContext();
@@ -611,11 +615,14 @@ public class TikaResource {
      * Accepts multipart with:
      * - "file" part (required): the document to parse
      * - "config" part (optional): JSON configuration for parser settings
+     * <p>
+     * This endpoint is gated behind enableUnsecureFeatures=true because per-request
+     * configuration could enable dangerous operations.
      */
     @POST
     @Consumes("multipart/form-data")
     @Produces("text/plain")
-    @Path("text")
+    @Path("config/text")
     public StreamingOutput postText(List<Attachment> attachments, @Context HttpHeaders httpHeaders)
             throws IOException {
         ParseContext context = createParseContext();
@@ -630,11 +637,14 @@ public class TikaResource {
      * Accepts multipart with:
      * - "file" part (required): the document to parse
      * - "config" part (optional): JSON configuration for parser settings
+     * <p>
+     * This endpoint is gated behind enableUnsecureFeatures=true because per-request
+     * configuration could enable dangerous operations.
      */
     @POST
     @Consumes("multipart/form-data")
     @Produces("text/html")
-    @Path("html")
+    @Path("config/html")
     public StreamingOutput postHtml(List<Attachment> attachments, @Context HttpHeaders httpHeaders)
             throws IOException {
         ParseContext context = createParseContext();
@@ -649,11 +659,14 @@ public class TikaResource {
      * Accepts multipart with:
      * - "file" part (required): the document to parse
      * - "config" part (optional): JSON configuration for parser settings
+     * <p>
+     * This endpoint is gated behind enableUnsecureFeatures=true because per-request
+     * configuration could enable dangerous operations.
      */
     @POST
     @Consumes("multipart/form-data")
     @Produces("text/xml")
-    @Path("xml")
+    @Path("config/xml")
     public StreamingOutput postXml(List<Attachment> attachments, @Context HttpHeaders httpHeaders)
             throws IOException {
         ParseContext context = createParseContext();
@@ -670,11 +683,14 @@ public class TikaResource {
      * - "config" part (optional): JSON configuration for parser settings and handler type
      * <p>
      * Default handler is text. Use config to specify different handler type.
+     * <p>
+     * This endpoint is gated behind enableUnsecureFeatures=true because per-request
+     * configuration could enable dangerous operations.
      */
     @POST
     @Consumes("multipart/form-data")
     @Produces("application/json")
-    @Path("json")
+    @Path("config/json")
     public Metadata postJson(List<Attachment> attachments, @Context HttpHeaders httpHeaders)
             throws IOException {
         ParseContext context = createParseContext();
diff --git a/tika-server/tika-server-core/src/test/java/org/apache/tika/server/core/ConfigEndpointSecurityEnabledTest.java b/tika-server/tika-server-core/src/test/java/org/apache/tika/server/core/ConfigEndpointSecurityEnabledTest.java
new file mode 100644
index 0000000000..0646f75ecd
--- /dev/null
+++ b/tika-server/tika-server-core/src/test/java/org/apache/tika/server/core/ConfigEndpointSecurityEnabledTest.java
@@ -0,0 +1,111 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one or more
+ * contributor license agreements.  See the NOTICE file distributed with
+ * this work for additional information regarding copyright ownership.
+ * The ASF licenses this file to You under the Apache License, Version 2.0
+ * (the "License"); you may not use this file except in compliance with
+ * the License.  You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.apache.tika.server.core;
+
+import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertTrue;
+
+import java.io.InputStream;
+import java.util.ArrayList;
+import java.util.Arrays;
+import java.util.List;
+
+import jakarta.ws.rs.core.Response;
+import org.apache.cxf.jaxrs.JAXRSServerFactoryBean;
+import org.apache.cxf.jaxrs.client.WebClient;
+import org.apache.cxf.jaxrs.ext.multipart.Attachment;
+import org.apache.cxf.jaxrs.ext.multipart.ContentDisposition;
+import org.apache.cxf.jaxrs.ext.multipart.MultipartBody;
+import org.apache.cxf.jaxrs.lifecycle.SingletonResourceProvider;
+import org.junit.jupiter.api.Test;
+
+import org.apache.tika.server.core.resource.TikaResource;
+import org.apache.tika.server.core.writer.JSONMessageBodyWriter;
+
+/**
+ * Tests that /config endpoints work when enableUnsecureFeatures=true.
+ */
+public class ConfigEndpointSecurityEnabledTest extends CXFTestBase {
+
+    private static final String TIKA_PATH = "/tika";
+    private static final String TEST_DOC = "test-documents/mock/hello_world.xml";
+
+    @Override
+    protected void setUpResources(JAXRSServerFactoryBean sf) {
+        sf.setResourceClasses(TikaResource.class);
+        sf.setResourceProvider(TikaResource.class, new SingletonResourceProvider(new TikaResource()));
+    }
+
+    @Override
+    protected void setUpProviders(JAXRSServerFactoryBean sf) {
+        List<Object> providers = new ArrayList<>();
+        providers.add(new TikaServerParseExceptionMapper(false));
+        providers.add(new JSONMessageBodyWriter());
+        // Add security filter with enableUnsecureFeatures=true
+        providers.add(new ConfigEndpointSecurityFilter(true));
+        sf.setProviders(providers);
+    }
+
+    @Test
+    public void testConfigEndpointAllowedWhenEnabled() throws Exception {
+        // POST to /tika/config should work with 200
+        ContentDisposition fileCd = new ContentDisposition("form-data; name=\"file\"; filename=\"test.xml\"");
+        Attachment fileAtt = new Attachment("file",
+                ClassLoader.getSystemResourceAsStream(TEST_DOC), fileCd);
+
+        Response response = WebClient
+                .create(endPoint + TIKA_PATH + "/config")
+                .type("multipart/form-data")
+                .post(new MultipartBody(Arrays.asList(fileAtt)));
+
+        assertEquals(200, response.getStatus());
+        String responseMsg = getStringFromInputStream((InputStream) response.getEntity());
+        assertTrue(responseMsg.contains("hello world"));
+    }
+
+    @Test
+    public void testConfigTextEndpointAllowedWhenEnabled() throws Exception {
+        // POST to /tika/config/text should work
+        ContentDisposition fileCd = new ContentDisposition("form-data; name=\"file\"; filename=\"test.xml\"");
+        Attachment fileAtt = new Attachment("file",
+                ClassLoader.getSystemResourceAsStream(TEST_DOC), fileCd);
+
+        Response response = WebClient
+                .create(endPoint + TIKA_PATH + "/config/text")
+                .type("multipart/form-data")
+                .post(new MultipartBody(Arrays.asList(fileAtt)));
+
+        assertEquals(200, response.getStatus());
+        String responseMsg = getStringFromInputStream((InputStream) response.getEntity());
+        assertTrue(responseMsg.contains("hello world"));
+    }
+
+    @Test
+    public void testConfigJsonEndpointAllowedWhenEnabled() throws Exception {
+        // POST to /tika/config/json should work
+        ContentDisposition fileCd = new ContentDisposition("form-data; name=\"file\"; filename=\"test.xml\"");
+        Attachment fileAtt = new Attachment("file",
+                ClassLoader.getSystemResourceAsStream(TEST_DOC), fileCd);
+
+        Response response = WebClient
+                .create(endPoint + TIKA_PATH + "/config/json")
+                .type("multipart/form-data")
+                .post(new MultipartBody(Arrays.asList(fileAtt)));
+
+        assertEquals(200, response.getStatus());
+    }
+}
diff --git a/tika-server/tika-server-core/src/test/java/org/apache/tika/server/core/ConfigEndpointSecurityTest.java b/tika-server/tika-server-core/src/test/java/org/apache/tika/server/core/ConfigEndpointSecurityTest.java
new file mode 100644
index 0000000000..cbb7b5aa86
--- /dev/null
+++ b/tika-server/tika-server-core/src/test/java/org/apache/tika/server/core/ConfigEndpointSecurityTest.java
@@ -0,0 +1,143 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one or more
+ * contributor license agreements.  See the NOTICE file distributed with
+ * this work for additional information regarding copyright ownership.
+ * The ASF licenses this file to You under the Apache License, Version 2.0
+ * (the "License"); you may not use this file except in compliance with
+ * the License.  You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.apache.tika.server.core;
+
+import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertTrue;
+
+import java.io.InputStream;
+import java.util.ArrayList;
+import java.util.Arrays;
+import java.util.List;
+
+import jakarta.ws.rs.core.Response;
+import org.apache.cxf.jaxrs.JAXRSServerFactoryBean;
+import org.apache.cxf.jaxrs.client.WebClient;
+import org.apache.cxf.jaxrs.ext.multipart.Attachment;
+import org.apache.cxf.jaxrs.ext.multipart.ContentDisposition;
+import org.apache.cxf.jaxrs.ext.multipart.MultipartBody;
+import org.apache.cxf.jaxrs.lifecycle.SingletonResourceProvider;
+import org.junit.jupiter.api.Test;
+
+import org.apache.tika.server.core.resource.TikaResource;
+import org.apache.tika.server.core.writer.JSONMessageBodyWriter;
+
+/**
+ * Tests for ConfigEndpointSecurityFilter.
+ * Verifies that /config endpoints are gated behind enableUnsecureFeatures.
+ */
+public class ConfigEndpointSecurityTest extends CXFTestBase {
+
+    private static final String TIKA_PATH = "/tika";
+    private static final String TEST_DOC = "test-documents/mock/hello_world.xml";
+
+    @Override
+    protected void setUpResources(JAXRSServerFactoryBean sf) {
+        sf.setResourceClasses(TikaResource.class);
+        sf.setResourceProvider(TikaResource.class, new SingletonResourceProvider(new TikaResource()));
+    }
+
+    @Override
+    protected void setUpProviders(JAXRSServerFactoryBean sf) {
+        List<Object> providers = new ArrayList<>();
+        providers.add(new TikaServerParseExceptionMapper(false));
+        providers.add(new JSONMessageBodyWriter());
+        // Add security filter with enableUnsecureFeatures=false
+        providers.add(new ConfigEndpointSecurityFilter(false));
+        sf.setProviders(providers);
+    }
+
+    @Test
+    public void testConfigEndpointBlockedWhenDisabled() throws Exception {
+        // POST to /tika/config should be blocked with 403
+        ContentDisposition fileCd = new ContentDisposition("form-data; name=\"file\"; filename=\"test.xml\"");
+        Attachment fileAtt = new Attachment("file",
+                ClassLoader.getSystemResourceAsStream(TEST_DOC), fileCd);
+
+        Response response = WebClient
+                .create(endPoint + TIKA_PATH + "/config")
+                .type("multipart/form-data")
+                .post(new MultipartBody(Arrays.asList(fileAtt)));
+
+        assertEquals(403, response.getStatus());
+        String responseMsg = getStringFromInputStream((InputStream) response.getEntity());
+        assertTrue(responseMsg.contains("Config endpoints are disabled"));
+    }
+
+    @Test
+    public void testConfigTextEndpointBlockedWhenDisabled() throws Exception {
+        // POST to /tika/config/text should be blocked with 403
+        ContentDisposition fileCd = new ContentDisposition("form-data; name=\"file\"; filename=\"test.xml\"");
+        Attachment fileAtt = new Attachment("file",
+                ClassLoader.getSystemResourceAsStream(TEST_DOC), fileCd);
+
+        Response response = WebClient
+                .create(endPoint + TIKA_PATH + "/config/text")
+                .type("multipart/form-data")
+                .post(new MultipartBody(Arrays.asList(fileAtt)));
+
+        assertEquals(403, response.getStatus());
+    }
+
+    @Test
+    public void testConfigJsonEndpointBlockedWhenDisabled() throws Exception {
+        // POST to /tika/config/json should be blocked with 403
+        ContentDisposition fileCd = new ContentDisposition("form-data; name=\"file\"; filename=\"test.xml\"");
+        Attachment fileAtt = new Attachment("file",
+                ClassLoader.getSystemResourceAsStream(TEST_DOC), fileCd);
+
+        Response response = WebClient
+                .create(endPoint + TIKA_PATH + "/config/json")
+                .type("multipart/form-data")
+                .post(new MultipartBody(Arrays.asList(fileAtt)));
+
+        assertEquals(403, response.getStatus());
+    }
+
+    @Test
+    public void testNonConfigEndpointsNotBlocked() throws Exception {
+        // GET to /tika should still work
+        Response response = WebClient
+                .create(endPoint + TIKA_PATH)
+                .get();
+
+        assertEquals(200, response.getStatus());
+        assertEquals(TikaResource.GREETING, getStringFromInputStream((InputStream) response.getEntity()));
+    }
+
+    @Test
+    public void testPutEndpointsNotBlocked() throws Exception {
+        // PUT to /tika/text should still work (no /config in path)
+        Response response = WebClient
+                .create(endPoint + TIKA_PATH + "/text")
+                .put(ClassLoader.getSystemResourceAsStream(TEST_DOC));
+
+        assertEquals(200, response.getStatus());
+        String responseMsg = getStringFromInputStream((InputStream) response.getEntity());
+        assertTrue(responseMsg.contains("hello world"));
+    }
+
+    @Test
+    public void testPutJsonEndpointNotBlocked() throws Exception {
+        // PUT to /tika/json should still work (no /config in path)
+        Response response = WebClient
+                .create(endPoint + TIKA_PATH + "/json")
+                .put(ClassLoader.getSystemResourceAsStream(TEST_DOC));
+
+        assertEquals(200, response.getStatus());
+    }
+}
diff --git a/tika-server/tika-server-standard/src/test/java/org/apache/tika/server/standard/TikaResourceTest.java b/tika-server/tika-server-standard/src/test/java/org/apache/tika/server/standard/TikaResourceTest.java
index c68220f9aa..0b4fe94fb0 100644
--- a/tika-server/tika-server-standard/src/test/java/org/apache/tika/server/standard/TikaResourceTest.java
+++ b/tika-server/tika-server-standard/src/test/java/org/apache/tika/server/standard/TikaResourceTest.java
@@ -260,7 +260,7 @@ public class TikaResourceTest extends CXFTestBase {
                 new java.io.ByteArrayInputStream(configJson.getBytes(StandardCharsets.UTF_8)));
 
         Response response = WebClient
-                .create(endPoint + TIKA_PATH)
+                .create(endPoint + TIKA_PATH + "/config")
                 .type("multipart/form-data")
                 .post(new MultipartBody(Arrays.asList(fileAtt, configAtt)));
         String responseMsg = getStringFromInputStream((InputStream) response.getEntity());
@@ -289,7 +289,7 @@ public class TikaResourceTest extends CXFTestBase {
                 new java.io.ByteArrayInputStream(configJson.getBytes(StandardCharsets.UTF_8)));
 
         Response response = WebClient
-                .create(endPoint + TIKA_PATH)
+                .create(endPoint + TIKA_PATH + "/config")
                 .type("multipart/form-data")
                 .post(new MultipartBody(Arrays.asList(fileAtt, configAtt)));
         String responseMsg = getStringFromInputStream((InputStream) response.getEntity());
@@ -304,7 +304,7 @@ public class TikaResourceTest extends CXFTestBase {
                 new java.io.ByteArrayInputStream(configJson.getBytes(StandardCharsets.UTF_8)));
 
         response = WebClient
-                .create(endPoint + TIKA_PATH)
+                .create(endPoint + TIKA_PATH + "/config")
                 .type("multipart/form-data")
                 .post(new MultipartBody(Arrays.asList(fileAtt, configAtt)));
         responseMsg = getStringFromInputStream((InputStream) response.getEntity());
@@ -325,7 +325,7 @@ public class TikaResourceTest extends CXFTestBase {
                 new java.io.ByteArrayInputStream(configJson.getBytes(StandardCharsets.UTF_8)));
 
         response = WebClient
-                .create(endPoint + TIKA_PATH)
+                .create(endPoint + TIKA_PATH + "/config")
                 .type("multipart/form-data")
                 .post(new MultipartBody(Arrays.asList(fileAtt, configAtt)));
         responseMsg = getStringFromInputStream((InputStream) response.getEntity());
@@ -346,7 +346,7 @@ public class TikaResourceTest extends CXFTestBase {
                 new java.io.ByteArrayInputStream(configJson.getBytes(StandardCharsets.UTF_8)));
 
         response = WebClient
-                .create(endPoint + TIKA_PATH)
+                .create(endPoint + TIKA_PATH + "/config")
                 .type("multipart/form-data")
                 .post(new MultipartBody(Arrays.asList(fileAtt, configAtt)));
         assertEquals(422, response.getStatus());
@@ -382,7 +382,7 @@ public class TikaResourceTest extends CXFTestBase {
                 new java.io.ByteArrayInputStream(configJson.getBytes(StandardCharsets.UTF_8)));
 
         response = WebClient
-                .create(endPoint + TIKA_PATH + "/text")
+                .create(endPoint + TIKA_PATH + "/config/text")
                 .type("multipart/form-data")
                 .post(new MultipartBody(Arrays.asList(fileAtt, configAtt)));
         responseMsg = getStringFromInputStream((InputStream) response.getEntity());
@@ -425,7 +425,7 @@ public class TikaResourceTest extends CXFTestBase {
 
         try {
             Response response = WebClient
-                    .create(endPoint + TIKA_PATH)
+                    .create(endPoint + TIKA_PATH + "/config")
                     .type("multipart/form-data")
                     .post(new MultipartBody(Arrays.asList(fileAtt, configAtt)));
             assertEquals(500, response.getStatus());
@@ -450,7 +450,7 @@ public class TikaResourceTest extends CXFTestBase {
 
         try {
             Response response = WebClient
-                    .create(endPoint + TIKA_PATH)
+                    .create(endPoint + TIKA_PATH + "/config")
                     .type("multipart/form-data")
                     .post(new MultipartBody(Arrays.asList(fileAtt, configAtt)));
             assertEquals(422, response.getStatus());
@@ -480,7 +480,7 @@ public class TikaResourceTest extends CXFTestBase {
                 new java.io.ByteArrayInputStream(configJson.getBytes(StandardCharsets.UTF_8)));
 
         Response response = WebClient
-                .create(endPoint + TIKA_PATH)
+                .create(endPoint + TIKA_PATH + "/config")
                 .type("multipart/form-data")
                 .post(new MultipartBody(Arrays.asList(fileAtt, configAtt)));
         assertEquals(422, response.getStatus());
@@ -502,7 +502,7 @@ public class TikaResourceTest extends CXFTestBase {
                 new java.io.ByteArrayInputStream(configJson.getBytes(StandardCharsets.UTF_8)));
 
         Response response = WebClient
-                .create(endPoint + TIKA_PATH)
+                .create(endPoint + TIKA_PATH + "/config")
                 .type("multipart/form-data")
                 .post(new MultipartBody(Arrays.asList(fileAtt, configAtt)));
         assertEquals(200, response.getStatus());
@@ -527,7 +527,7 @@ public class TikaResourceTest extends CXFTestBase {
                 new java.io.ByteArrayInputStream(configJson.getBytes(StandardCharsets.UTF_8)));
 
         Response response = WebClient
-                .create(endPoint + TIKA_PATH + "/text")
+                .create(endPoint + TIKA_PATH + "/config/text")
                 .type("multipart/form-data")
                 .post(new MultipartBody(Arrays.asList(fileAtt, configAtt)));
         String responseMsg = getStringFromInputStream((InputStream) response.getEntity());
@@ -549,7 +549,7 @@ public class TikaResourceTest extends CXFTestBase {
                 new java.io.ByteArrayInputStream(configJson.getBytes(StandardCharsets.UTF_8)));
 
         Response response = WebClient
-                .create(endPoint + TIKA_PATH + "/text")
+                .create(endPoint + TIKA_PATH + "/config/text")
                 .type("multipart/form-data")
                 .post(new MultipartBody(Arrays.asList(fileAtt, configAtt)));
         String responseMsg = getStringFromInputStream((InputStream) response.getEntity());
@@ -580,7 +580,7 @@ public class TikaResourceTest extends CXFTestBase {
                 new java.io.ByteArrayInputStream(configJson.getBytes(StandardCharsets.UTF_8)));
 
         response = WebClient
-                .create(endPoint + TIKA_PATH)
+                .create(endPoint + TIKA_PATH + "/config")
                 .type("multipart/form-data")
                 .post(new MultipartBody(Arrays.asList(fileAtt, configAtt)));
         responseMsg = getStringFromInputStream((InputStream) response.getEntity());