(tika) 04/24: TIKA-4809: Reserve the server's internal fetcher and emitter from /pipes and /async

[ta...@apache.org]

This is an automated email from the ASF dual-hosted git repository.

tballison pushed a commit to branch TIKA-4809-stage-9
in repository https://gitbox.apache.org/repos/asf/tika.git

commit 8d9c9e395bf824ac3ea35409ef87b4ee68f382cb
Author: tallison <ta...@apache.org>
AuthorDate: Mon Aug 10 14:45:05 2026 -0400

    TIKA-4809: Reserve the server's internal fetcher and emitter from /pipes and /async
---
 .../tika/server/core/resource/AsyncResource.java   |  1 +
 .../server/core/resource/PipesParsingHelper.java   | 37 ++++++++++
 .../tika/server/core/resource/PipesResource.java   |  2 +-
 .../org/apache/tika/server/core/TikaPipesTest.java |  1 +
 .../core/resource/ReservedComponentIdTest.java     | 79 ++++++++++++++++++++++
 5 files changed, 119 insertions(+), 1 deletion(-)

diff --git a/tika-server/tika-server-core/src/main/java/org/apache/tika/server/core/resource/AsyncResource.java b/tika-server/tika-server-core/src/main/java/org/apache/tika/server/core/resource/AsyncResource.java
index f013f4eff4..420bbafd8c 100644
--- a/tika-server/tika-server-core/src/main/java/org/apache/tika/server/core/resource/AsyncResource.java
+++ b/tika-server/tika-server-core/src/main/java/org/apache/tika/server/core/resource/AsyncResource.java
@@ -106,6 +106,7 @@ public class AsyncResource {
         //the requested fetchers and emitters
         //throw early
         for (FetchEmitTuple t : request.getTuples()) {
+            PipesParsingHelper.rejectReservedComponentIds(t);
             if (!emitterManager
                     .getSupported()
                     .contains(t
diff --git a/tika-server/tika-server-core/src/main/java/org/apache/tika/server/core/resource/PipesParsingHelper.java b/tika-server/tika-server-core/src/main/java/org/apache/tika/server/core/resource/PipesParsingHelper.java
index a667548c9a..0b0a14bc16 100644
--- a/tika-server/tika-server-core/src/main/java/org/apache/tika/server/core/resource/PipesParsingHelper.java
+++ b/tika-server/tika-server-core/src/main/java/org/apache/tika/server/core/resource/PipesParsingHelper.java
@@ -22,11 +22,13 @@ import java.nio.file.Files;
 import java.nio.file.Path;
 import java.util.Collections;
 import java.util.List;
+import java.util.Set;
 import java.util.UUID;
 import java.util.concurrent.TimeUnit;
 
 import com.fasterxml.jackson.databind.ObjectMapper;
 import com.fasterxml.jackson.databind.node.ObjectNode;
+import jakarta.ws.rs.BadRequestException;
 import jakarta.ws.rs.WebApplicationException;
 import jakarta.ws.rs.core.HttpHeaders;
 import jakarta.ws.rs.core.MediaType;
@@ -380,6 +382,41 @@ public class PipesParsingHelper {
      */
     public static final String UNPACK_EMITTER_ID = "unpack-emitter";
 
+    /**
+     * Fetcher/emitter ids the server wires up for its own request plumbing. Both are rooted at
+     * the server's spool directories, so a caller who names one is reaching into other requests'
+     * in-flight files rather than into storage of their own -- reading a pending upload through
+     * the fetcher, or planting a file the unpack download path will hand back through the
+     * emitter. The ids are not secret; they are compiled in and documented.
+     * <p>
+     * Applies only to caller-supplied tuples (/pipes, /async). This class names them itself when
+     * it builds the tuples for /tika, /rmeta, and /unpack, which is exactly the use being
+     * reserved.
+     */
+    private static final Set<String> RESERVED_COMPONENT_IDS =
+            Set.of(DEFAULT_FETCHER_ID, UNPACK_EMITTER_ID);
+
+    /**
+     * @throws BadRequestException if a caller-supplied tuple names a server-internal component.
+     */
+    public static void rejectReservedComponentIds(FetchEmitTuple t) {
+        checkNotReserved(t.getFetchKey() == null ? null : t.getFetchKey().getFetcherId(), "fetcher");
+        checkNotReserved(t.getEmitKey() == null ? null : t.getEmitKey().getEmitterId(), "emitter");
+        UnpackConfig unpackConfig = t.getParseContext() == null
+                ? null : t.getParseContext().get(UnpackConfig.class);
+        if (unpackConfig != null) {
+            checkNotReserved(unpackConfig.getEmitter(), "emitter");
+        }
+    }
+
+    private static void checkNotReserved(String id, String kind) {
+        if (id != null && RESERVED_COMPONENT_IDS.contains(id)) {
+            throw new BadRequestException(
+                    "'" + id + "' is reserved for tika-server's internal use and may not be named as a "
+                            + kind + " by a request");
+        }
+    }
+
     /**
      * Parses content using UNPACK mode and returns a path to the zip file containing
      * extracted embedded documents.
diff --git a/tika-server/tika-server-core/src/main/java/org/apache/tika/server/core/resource/PipesResource.java b/tika-server/tika-server-core/src/main/java/org/apache/tika/server/core/resource/PipesResource.java
index efb1c52c57..1dd71d0b81 100644
--- a/tika-server/tika-server-core/src/main/java/org/apache/tika/server/core/resource/PipesResource.java
+++ b/tika-server/tika-server-core/src/main/java/org/apache/tika/server/core/resource/PipesResource.java
@@ -98,6 +98,7 @@ public class PipesResource {
     }
 
     private Response processTuple(FetchEmitTuple fetchEmitTuple) throws InterruptedException, PipesException, IOException {
+        PipesParsingHelper.rejectReservedComponentIds(fetchEmitTuple);
         // This parser is shared with /tika+/rmeta+/unpack, whose own default is
         // PASSBACK_ALL. /pipes needs the child to emit via the client's configured
         // emitter by default -- set EMIT_ALL explicitly per-request rather than
@@ -135,7 +136,6 @@ public class PipesResource {
     private Map<String, String> parseException(String msg, boolean emitted) {
         Map<String, String> statusMap = new HashMap<>();
         statusMap.put("status", "ok");
-        // 200 response, so trim rather than omit -- same reasoning as redactExceptionDetail.
         statusMap.put("parse_exception", msg);
         statusMap.put("emitted", Boolean.toString(emitted));
         return statusMap;
diff --git a/tika-server/tika-server-core/src/test/java/org/apache/tika/server/core/TikaPipesTest.java b/tika-server/tika-server-core/src/test/java/org/apache/tika/server/core/TikaPipesTest.java
index 8e1fda53a7..a5537737c3 100644
--- a/tika-server/tika-server-core/src/test/java/org/apache/tika/server/core/TikaPipesTest.java
+++ b/tika-server/tika-server-core/src/test/java/org/apache/tika/server/core/TikaPipesTest.java
@@ -347,4 +347,5 @@ public class TikaPipesTest extends CXFTestBase {
                 .post(writer.toString());
     }
 
+
 }
diff --git a/tika-server/tika-server-core/src/test/java/org/apache/tika/server/core/resource/ReservedComponentIdTest.java b/tika-server/tika-server-core/src/test/java/org/apache/tika/server/core/resource/ReservedComponentIdTest.java
new file mode 100644
index 0000000000..76972bb193
--- /dev/null
+++ b/tika-server/tika-server-core/src/test/java/org/apache/tika/server/core/resource/ReservedComponentIdTest.java
@@ -0,0 +1,79 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one or more
+ * contributor license agreements.  See the NOTICE file distributed with
+ * this work for additional information regarding copyright ownership.
+ * The ASF licenses this file to You under the Apache License, Version 2.0
+ * (the "License"); you may not use this file except in compliance with
+ * the License.  You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.apache.tika.server.core.resource;
+
+import static org.junit.jupiter.api.Assertions.assertDoesNotThrow;
+import static org.junit.jupiter.api.Assertions.assertThrows;
+
+import jakarta.ws.rs.BadRequestException;
+import org.junit.jupiter.api.Test;
+
+import org.apache.tika.metadata.Metadata;
+import org.apache.tika.parser.ParseContext;
+import org.apache.tika.pipes.api.FetchEmitTuple;
+import org.apache.tika.pipes.api.emitter.EmitKey;
+import org.apache.tika.pipes.api.fetcher.FetchKey;
+import org.apache.tika.pipes.core.extractor.UnpackConfig;
+
+/**
+ * The server configures {@code tika-server-fetcher} and {@code unpack-emitter} against its own
+ * spool directories. They exist on every running server, so unlike an unknown id these would
+ * resolve if a /pipes or /async caller named them -- reading another request's pending upload,
+ * or planting a file where the unpack download path serves from.
+ * <p>
+ * Tested directly rather than over HTTP: an endpoint test would have to run against a config
+ * where these ids are actually wired up, and against any other config it passes for the wrong
+ * reason (400 for "no such fetcher").
+ */
+public class ReservedComponentIdTest {
+
+    @Test
+    public void testReservedFetcherRejected() {
+        assertThrows(BadRequestException.class, () -> PipesParsingHelper.rejectReservedComponentIds(
+                tuple(PipesParsingHelper.DEFAULT_FETCHER_ID, "my-emitter", null)));
+    }
+
+    @Test
+    public void testReservedEmitterRejected() {
+        assertThrows(BadRequestException.class, () -> PipesParsingHelper.rejectReservedComponentIds(
+                tuple("my-fetcher", PipesParsingHelper.UNPACK_EMITTER_ID, null)));
+    }
+
+    /** The bytes emitter is a second, easily missed way to name an emitter. */
+    @Test
+    public void testReservedUnpackBytesEmitterRejected() {
+        assertThrows(BadRequestException.class, () -> PipesParsingHelper.rejectReservedComponentIds(
+                tuple("my-fetcher", "my-emitter", PipesParsingHelper.UNPACK_EMITTER_ID)));
+    }
+
+    @Test
+    public void testCallerComponentsAllowed() {
+        assertDoesNotThrow(() -> PipesParsingHelper.rejectReservedComponentIds(
+                tuple("my-fetcher", "my-emitter", "my-bytes-emitter")));
+    }
+
+    private static FetchEmitTuple tuple(String fetcherId, String emitterId, String bytesEmitterId) {
+        ParseContext parseContext = new ParseContext();
+        if (bytesEmitterId != null) {
+            UnpackConfig unpackConfig = new UnpackConfig();
+            unpackConfig.setEmitter(bytesEmitterId);
+            parseContext.set(UnpackConfig.class, unpackConfig);
+        }
+        return new FetchEmitTuple("id", new FetchKey(fetcherId, "key"),
+                new EmitKey(emitterId, "key"), new Metadata(), parseContext);
+    }
+}