shiro-dev mailing list archives

Site index · List index
Message view « Date » · « Thread »
Top « Date » · « Thread »
From "Christian Thum (JIRA)" <j...@apache.org>
Subject [jira] [Updated] (SHIRO-582) NullPointerException in AntPathMatcher
Date Mon, 22 Aug 2016 13:11:20 GMT

     [ https://issues.apache.org/jira/browse/SHIRO-582?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel
]

Christian Thum updated SHIRO-582:
---------------------------------
    Description: 
{{WebUtils.getRequestUri}} uses the {{normalize}} method  to canonicalize the request URI.
During an automated pentest, we found that a request to the following URL will cause a NPE:

{{curl --path-as-is "http://127.0.0.1/\../\../\../\../\../\../Server4/admin-serv/config/adm.conf"}}

The request will cause the path parameter of the `doMatch`method in org.apache.shiro.util.AntPathMatcher
to be null. Executing the line

{quote}
{{ if (path.startsWith(this.pathSeparator) != pattern.startsWith(this.pathSeparator)) }} will
throw the NPE.
{quote}

This could be handled by adjusting the {{normalize}} method or null checking the path in the
{{doMatch}} method.

*Stacktrace*
{quote}
java.lang.NullPointerException
	at org.apache.shiro.util.AntPathMatcher.doMatch(AntPathMatcher.java:109)
	at org.apache.shiro.util.AntPathMatcher.match(AntPathMatcher.java:90)
	at org.apache.shiro.util.AntPathMatcher.matches(AntPathMatcher.java:86)
	at org.apache.shiro.web.filter.mgt.PathMatchingFilterChainResolver.pathMatches(PathMatchingFilterChainResolver.java:135)
	at org.apache.shiro.web.filter.mgt.PathMatchingFilterChainResolver.getChain(PathMatchingFilterChainResolver.java:106)
	at org.apache.shiro.web.servlet.AbstractShiroFilter.getExecutionChain(AbstractShiroFilter.java:415)
	at org.apache.shiro.web.servlet.AbstractShiroFilter.executeChain(AbstractShiroFilter.java:448)
{quote}



  was:
{{WebUtils.getRequestUri}} uses the {{normalize}} method  to canonicalize the request URI.
During an automated pentest, we found that a request following to the following URL will cause
a NPE:

{{curl --path-as-is "http://127.0.0.1/\../\../\../\../\../\../Server4/admin-serv/config/adm.conf"}}

The request will cause the path parameter of the `doMatch`method in org.apache.shiro.util.AntPathMatcher
to be null. Executing the line

{quote}
{{ if (path.startsWith(this.pathSeparator) != pattern.startsWith(this.pathSeparator)) }} will
throw the NPE.
{quote}

This could be handled by adjusting the {{normalize}} method or null checking the path in the
{{doMatch}} method.

*Stacktrace*
{quote}
java.lang.NullPointerException
	at org.apache.shiro.util.AntPathMatcher.doMatch(AntPathMatcher.java:109)
	at org.apache.shiro.util.AntPathMatcher.match(AntPathMatcher.java:90)
	at org.apache.shiro.util.AntPathMatcher.matches(AntPathMatcher.java:86)
	at org.apache.shiro.web.filter.mgt.PathMatchingFilterChainResolver.pathMatches(PathMatchingFilterChainResolver.java:135)
	at org.apache.shiro.web.filter.mgt.PathMatchingFilterChainResolver.getChain(PathMatchingFilterChainResolver.java:106)
	at org.apache.shiro.web.servlet.AbstractShiroFilter.getExecutionChain(AbstractShiroFilter.java:415)
	at org.apache.shiro.web.servlet.AbstractShiroFilter.executeChain(AbstractShiroFilter.java:448)
{quote}




> NullPointerException in AntPathMatcher
> --------------------------------------
>
>                 Key: SHIRO-582
>                 URL: https://issues.apache.org/jira/browse/SHIRO-582
>             Project: Shiro
>          Issue Type: Bug
>          Components: Authorization (access control) 
>    Affects Versions: 1.3.0
>            Reporter: Christian Thum
>
> {{WebUtils.getRequestUri}} uses the {{normalize}} method  to canonicalize the request
URI. During an automated pentest, we found that a request to the following URL will cause
a NPE:
> {{curl --path-as-is "http://127.0.0.1/\../\../\../\../\../\../Server4/admin-serv/config/adm.conf"}}
> The request will cause the path parameter of the `doMatch`method in org.apache.shiro.util.AntPathMatcher
to be null. Executing the line
> {quote}
> {{ if (path.startsWith(this.pathSeparator) != pattern.startsWith(this.pathSeparator))
}} will throw the NPE.
> {quote}
> This could be handled by adjusting the {{normalize}} method or null checking the path
in the {{doMatch}} method.
> *Stacktrace*
> {quote}
> java.lang.NullPointerException
> 	at org.apache.shiro.util.AntPathMatcher.doMatch(AntPathMatcher.java:109)
> 	at org.apache.shiro.util.AntPathMatcher.match(AntPathMatcher.java:90)
> 	at org.apache.shiro.util.AntPathMatcher.matches(AntPathMatcher.java:86)
> 	at org.apache.shiro.web.filter.mgt.PathMatchingFilterChainResolver.pathMatches(PathMatchingFilterChainResolver.java:135)
> 	at org.apache.shiro.web.filter.mgt.PathMatchingFilterChainResolver.getChain(PathMatchingFilterChainResolver.java:106)
> 	at org.apache.shiro.web.servlet.AbstractShiroFilter.getExecutionChain(AbstractShiroFilter.java:415)
> 	at org.apache.shiro.web.servlet.AbstractShiroFilter.executeChain(AbstractShiroFilter.java:448)
> {quote}



--
This message was sent by Atlassian JIRA
(v6.3.4#6332)

Mime
View raw message