[jira] [Work started] (CAMEL-24412) camel-netty-http - security constraint lookup must use the same case-insensitive path matching as dispatch

["Andrea Cosentino (Jira)" <ji...@apache.org>]

     [ https://issues.apache.org/jira/browse/CAMEL-24412?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ]

Work on CAMEL-24412 started by Andrea Cosentino.
------------------------------------------------
> camel-netty-http - security constraint lookup must use the same case-insensitive path matching as dispatch
> ----------------------------------------------------------------------------------------------------------
>
>                 Key: CAMEL-24412
>                 URL: https://issues.apache.org/jira/browse/CAMEL-24412
>             Project: Camel
>          Issue Type: Bug
>          Components: camel-netty-http
>            Reporter: Andrea Cosentino
>            Assignee: Andrea Cosentino
>            Priority: Major
>             Fix For: 4.23.0
>
>
> HttpServerChannelHandler.extractTarget() strips the endpoint context-path from the request target so the security constraint can be evaluated relative to the endpoint:
>     String path = consumer.getConfiguration().getPath();
>     if (path != null && target.startsWith(path)) {
>         // need to match by lower case as we want to ignore case on context-path
>         path = path.toLowerCase(Locale.US);
>         String match = target.toLowerCase(Locale.US);
>         if (match.startsWith(path)) {
>             target = target.substring(path.length());
>         }
>     }
> The outer guard is case-sensitive, so the inner case-insensitive comparison can never change the outcome - it is dead code. When the request path differs from the configured path only by case the strip does not happen and SecurityConstraint.restricted() is evaluated against the unstripped, differently-cased target.
> Consumer dispatch does not have this property: RestConsumerContextPathMatcher.matchPath() uses equalsIgnoreCase() and a lower-cased prefix comparison, so the request still reaches the route. Authorization and dispatch therefore disagree about which endpoint a request belongs to.
> Proposal: perform the strip on the case-insensitive comparison (drop the case-sensitive outer guard) so that both the constraint lookup and dispatch consume the same normalised path. Worth a regression test asserting that a differently-cased context path yields the same constraint decision.



--
This message was sent by Atlassian Jira
(v8.20.10#820010)