-
Notifications
You must be signed in to change notification settings - Fork 896
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Fix arbitrary file upload vulnerability with httpServerEnabled #3982
Merged
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
wenbingshen
approved these changes
Jun 11, 2023
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
This change make sense to me.
shoothzj
approved these changes
Jun 12, 2023
@Shawyeok Please fix the checkstyle issue in your code. |
Fixed, PTAL |
dlg99
approved these changes
Jun 12, 2023
zymap
approved these changes
Jun 12, 2023
hangc0276
approved these changes
Jun 13, 2023
zymap
pushed a commit
that referenced
this pull request
Jun 19, 2023
### Motivation There is a potential arbitrary file upload vulnerability with `httpServerEnabled=true`, it's caused by `BodyHandler.create()` which returns a BodyHandler that automatically processes file upload requests. https://github.com/apache/bookkeeper/blob/7f64246ad38981126cc8dd929ff448805a738b8f/bookkeeper-http/vertx-http-server/src/main/java/org/apache/bookkeeper/http/vertx/VertxHttpServer.java#L82 This simple command will upload a file into the `file-uploads` directory under the bookkeeper server process `CWD`. ```shell $ curl -i --request POST \ --url http://localhost:8000/api/v1/bookie/info \ --header 'Content-Type: multipart/form-data' \ --form file=@<a-path-of-the-file> $ ls LICENSE NOTICE README.md bin conf deps file-uploads lib logs scripts $ ls file-uploads 758801ba-ea1e-49e3-85d6-e510f539ea0d ``` ### Changes Create the `BodyHandler` with handleFileUploads disabled (`BodyHandler.create(false)`). (cherry picked from commit 1809e69)
hangc0276
pushed a commit
to hangc0276/bookkeeper
that referenced
this pull request
Jun 26, 2023
…e#3982) ### Motivation There is a potential arbitrary file upload vulnerability with `httpServerEnabled=true`, it's caused by `BodyHandler.create()` which returns a BodyHandler that automatically processes file upload requests. https://github.com/apache/bookkeeper/blob/7f64246ad38981126cc8dd929ff448805a738b8f/bookkeeper-http/vertx-http-server/src/main/java/org/apache/bookkeeper/http/vertx/VertxHttpServer.java#L82 This simple command will upload a file into the `file-uploads` directory under the bookkeeper server process `CWD`. ```shell $ curl -i --request POST \ --url http://localhost:8000/api/v1/bookie/info \ --header 'Content-Type: multipart/form-data' \ --form file=@<a-path-of-the-file> $ ls LICENSE NOTICE README.md bin conf deps file-uploads lib logs scripts $ ls file-uploads 758801ba-ea1e-49e3-85d6-e510f539ea0d ``` ### Changes Create the `BodyHandler` with handleFileUploads disabled (`BodyHandler.create(false)`). (cherry picked from commit 1809e69)
zymap
pushed a commit
that referenced
this pull request
Dec 7, 2023
### Motivation There is a potential arbitrary file upload vulnerability with `httpServerEnabled=true`, it's caused by `BodyHandler.create()` which returns a BodyHandler that automatically processes file upload requests. https://github.com/apache/bookkeeper/blob/7f64246ad38981126cc8dd929ff448805a738b8f/bookkeeper-http/vertx-http-server/src/main/java/org/apache/bookkeeper/http/vertx/VertxHttpServer.java#L82 This simple command will upload a file into the `file-uploads` directory under the bookkeeper server process `CWD`. ```shell $ curl -i --request POST \ --url http://localhost:8000/api/v1/bookie/info \ --header 'Content-Type: multipart/form-data' \ --form file=@<a-path-of-the-file> $ ls LICENSE NOTICE README.md bin conf deps file-uploads lib logs scripts $ ls file-uploads 758801ba-ea1e-49e3-85d6-e510f539ea0d ``` ### Changes Create the `BodyHandler` with handleFileUploads disabled (`BodyHandler.create(false)`). (cherry picked from commit 1809e69)
Ghatage
pushed a commit
to sijie/bookkeeper
that referenced
this pull request
Jul 12, 2024
…e#3982) ### Motivation There is a potential arbitrary file upload vulnerability with `httpServerEnabled=true`, it's caused by `BodyHandler.create()` which returns a BodyHandler that automatically processes file upload requests. https://github.com/apache/bookkeeper/blob/7f64246ad38981126cc8dd929ff448805a738b8f/bookkeeper-http/vertx-http-server/src/main/java/org/apache/bookkeeper/http/vertx/VertxHttpServer.java#L82 This simple command will upload a file into the `file-uploads` directory under the bookkeeper server process `CWD`. ```shell $ curl -i --request POST \ --url http://localhost:8000/api/v1/bookie/info \ --header 'Content-Type: multipart/form-data' \ --form file=@<a-path-of-the-file> $ ls LICENSE NOTICE README.md bin conf deps file-uploads lib logs scripts $ ls file-uploads 758801ba-ea1e-49e3-85d6-e510f539ea0d ``` ### Changes Create the `BodyHandler` with handleFileUploads disabled (`BodyHandler.create(false)`).
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Motivation
There is a potential arbitrary file upload vulnerability with
httpServerEnabled=true
, it's caused byBodyHandler.create()
which returns a BodyHandler that automatically processes file upload requests.bookkeeper/bookkeeper-http/vertx-http-server/src/main/java/org/apache/bookkeeper/http/vertx/VertxHttpServer.java
Line 82 in 7f64246
This simple command will upload a file into the
file-uploads
directory under the bookkeeper server processCWD
.Changes
Create the
BodyHandler
with handleFileUploads disabled (BodyHandler.create(false)
).