You are viewing a plain text version of this content. The canonical link for it is here.

Posted to dev@shiro.apache.org by "Christian Thum (JIRA)" <ji...@apache.org> on 2016/08/22 13:00:24 UTC

[jira] [Created] (SHIRO-582) NullPointerException in AntPathMatcher

Christian Thum created SHIRO-582:
------------------------------------

             Summary: NullPointerException in AntPathMatcher
                 Key: SHIRO-582
                 URL: https://issues.apache.org/jira/browse/SHIRO-582
             Project: Shiro
          Issue Type: Bug
          Components: Authorization (access control) 
    Affects Versions: 1.3.0
            Reporter: Christian Thum


`WebUtils.getRequestUri` uses the `normalize`method  to canonicalize the request URI. During an automated pentest, we found that a request following to the following URL will cause a NPE:

`curl --path-as-is "http://127.0.0.1/\../\../\../\../\../\../Server4/admin-serv/config/adm.conf"`

The request will cause the path parameter of the `doMatch`method in org.apache.shiro.util.AntPathMatcher to be null. Executing the line

` if (path.startsWith(this.pathSeparator) != pattern.startsWith(this.pathSeparator)) {` will throw the NPE.

This could be handled by adjusting the normalize method or null checking the path in the doMatch method.




--
This message was sent by Atlassian JIRA
(v6.3.4#6332)