search

mkopylec / charon-spring-boot-starter

Reverse proxy implementation in form of a Spring Boot starter.
Apache License 2.0
240 stars 54 forks source link

RegexRequestPathRewriter.forward fails for URIs with Blank (%20) #115

Closed mararn1618 closed 3 years ago

mararn1618 commented 3 years ago

I am using Charon to forward and rewrite some requests, in particular I use

For URIs such as /quickbrain/merge/PROJECT_CODE/EVIL%20BLANK, I'm getting an exception. When I remove the encoded blank (%20) everything is fine.

The exception I get is about a decoded blank ' ' (not %20):

java.lang.IllegalArgumentException: Invalid character ' ' for PATH in "/quickbrain/merge/PROJECT_CODE/EVIL BLANK"

When checking the request before it reaches com.github.mkopylec.charon.forwarding.interceptors.HttpRequestInterceptor I can see that the blank ist still encoded (still '%20' and not ' ').

My Charon code:

@Configuration
public class ReverseProxyCharonConfiguration {

    @Value("${proxy.quickbrain.srcPath}")
    String srcPath;
    @Value("${proxy.quickbrain.dstServer}")
    String dstServer;

    @Bean
    CharonConfigurer charonConfigurer() {
        return charonConfiguration().filterOrder(org.springframework.core.Ordered.LOWEST_PRECEDENCE)
                .set(requestServerNameRewriter().outgoingServers(dstServer))
                .set(CustomInterceptorConfigurerAddAtlassianHostUser.customInterceptor())

                // https://github.com/mkopylec/charon-spring-boot-starter/blob/master/charon-spring-webmvc/src/test/java/com/github/mkopylec/charon/test/ReverseProxyConfiguration.java
                .add(requestMapping(this.srcPath + ".*")// just the name
                        .pathRegex(this.srcPath + ".*")// match
                        .set(

                                /*-------------------------- THIS ONE IS CAUSING THE TROUBLE --------------------------*/

                                regexRequestPathRewriter().paths(this.srcPath + "(?<group>.*)", "/<group>")

                                /*-------------------------- THIS ONE IS CAUSING THE TROUBLE --------------------------*/

                        ).set(restTemplate()
                                .set(timeout().connection(ofSeconds(5)).read(ofMinutes(1)).write(ofMinutes(1))))
                );
    }
}

The full exception:


java.lang.IllegalArgumentException: Invalid character ' ' for PATH in "/quickbrain/merge/PROJECT_CODE/EVIL BLANK"

    at org.springframework.web.util.HierarchicalUriComponents.verifyUriComponent(HierarchicalUriComponents.java:416) ~[spring-web-5.3.2.jar:5.3.2]
    at org.springframework.web.util.HierarchicalUriComponents.access$200(HierarchicalUriComponents.java:53) ~[spring-web-5.3.2.jar:5.3.2]
    at org.springframework.web.util.HierarchicalUriComponents$FullPathComponent.verify(HierarchicalUriComponents.java:884) ~[spring-web-5.3.2.jar:5.3.2]
    at org.springframework.web.util.HierarchicalUriComponents.verify(HierarchicalUriComponents.java:380) ~[spring-web-5.3.2.jar:5.3.2]
    at org.springframework.web.util.HierarchicalUriComponents.<init>(HierarchicalUriComponents.java:145) ~[spring-web-5.3.2.jar:5.3.2]
    at org.springframework.web.util.UriComponentsBuilder.buildInternal(UriComponentsBuilder.java:470) ~[spring-web-5.3.2.jar:5.3.2]

/*-------------------------- THIS ONE IS CAUSING THE TROUBLE ------------------------- */

    at org.springframework.web.util.UriComponentsBuilder.build(UriComponentsBuilder.java:459) ~[spring-web-5.3.2.jar:5.3.2]
    at com.github.mkopylec.charon.forwarding.interceptors.rewrite.CommonRegexRequestPathRewriter.rewritePath(CommonRegexRequestPathRewriter.java:51) ~[charon-spring-webmvc-4.8.0.jar:na]
    at com.github.mkopylec.charon.forwarding.interceptors.rewrite.RegexRequestPathRewriter.forward(RegexRequestPathRewriter.java:22) ~[charon-spring-webmvc-4.8.0.jar:na]
    at com.github.mkopylec.charon.forwarding.interceptors.HttpRequestInterceptor.intercept(HttpRequestInterceptor.java:25) ~[charon-spring-webmvc-4.8.0.jar:na]

/*-------------------------- THIS ONE IS CAUSING THE TROUBLE ------------------------- */

    at org.springframework.http.client.InterceptingClientHttpRequest$InterceptingRequestExecution.execute(InterceptingClientHttpRequest.java:93) ~[spring-web-5.3.2.jar:5.3.2]
    at com.github.mkopylec.charon.forwarding.interceptors.HttpRequestExecution.execute(HttpRequestExecution.java:22) ~[charon-spring-webmvc-4.8.0.jar:na]
    at com.github.mkopylec.charon.forwarding.interceptors.rewrite.RequestServerNameRewriter.forward(RequestServerNameRewriter.java:23) ~[charon-spring-webmvc-4.8.0.jar:na]
    at com.github.mkopylec.charon.forwarding.interceptors.HttpRequestInterceptor.intercept(HttpRequestInterceptor.java:25) ~[charon-spring-webmvc-4.8.0.jar:na]
    at org.springframework.http.client.InterceptingClientHttpRequest$InterceptingRequestExecution.execute(InterceptingClientHttpRequest.java:93) ~[spring-web-5.3.2.jar:5.3.2]
    at com.github.mkopylec.charon.forwarding.interceptors.HttpRequestExecution.execute(HttpRequestExecution.java:22) ~[charon-spring-webmvc-4.8.0.jar:na]
    at com.duplicateai.apigateway.quickbrain.ReverseProxyCharonAddAtlassianHostUser.forward(ReverseProxyCharonAddAtlassianHostUser.java:61) ~[classes/:na]
    at com.github.mkopylec.charon.forwarding.interceptors.HttpRequestInterceptor.intercept(HttpRequestInterceptor.java:25) ~[charon-spring-webmvc-4.8.0.jar:na]
    at org.springframework.http.client.InterceptingClientHttpRequest$InterceptingRequestExecution.execute(InterceptingClientHttpRequest.java:93) ~[spring-web-5.3.2.jar:5.3.2]
    at com.github.mkopylec.charon.forwarding.interceptors.HttpRequestExecution.execute(HttpRequestExecution.java:22) ~[charon-spring-webmvc-4.8.0.jar:na]
    at com.github.mkopylec.charon.forwarding.interceptors.rewrite.RequestProtocolHeadersRewriter.forward(RequestProtocolHeadersRewriter.java:23) ~[charon-spring-webmvc-4.8.0.jar:na]
    at com.github.mkopylec.charon.forwarding.interceptors.HttpRequestInterceptor.intercept(HttpRequestInterceptor.java:25) ~[charon-spring-webmvc-4.8.0.jar:na]
    at org.springframework.http.client.InterceptingClientHttpRequest$InterceptingRequestExecution.execute(InterceptingClientHttpRequest.java:93) ~[spring-web-5.3.2.jar:5.3.2]
    at com.github.mkopylec.charon.forwarding.interceptors.HttpRequestExecution.execute(HttpRequestExecution.java:22) ~[charon-spring-webmvc-4.8.0.jar:na]
    at com.github.mkopylec.charon.forwarding.interceptors.log.ForwardingLogger.forward(ForwardingLogger.java:29) ~[charon-spring-webmvc-4.8.0.jar:na]
    at com.github.mkopylec.charon.forwarding.interceptors.HttpRequestInterceptor.intercept(HttpRequestInterceptor.java:25) ~[charon-spring-webmvc-4.8.0.jar:na]
    at org.springframework.http.client.InterceptingClientHttpRequest$InterceptingRequestExecution.execute(InterceptingClientHttpRequest.java:93) ~[spring-web-5.3.2.jar:5.3.2]
    at org.springframework.http.client.InterceptingClientHttpRequest.executeInternal(InterceptingClientHttpRequest.java:77) ~[spring-web-5.3.2.jar:5.3.2]
    at org.springframework.http.client.AbstractBufferingClientHttpRequest.executeInternal(AbstractBufferingClientHttpRequest.java:48) ~[spring-web-5.3.2.jar:5.3.2]
    at org.springframework.http.client.AbstractClientHttpRequest.execute(AbstractClientHttpRequest.java:66) ~[spring-web-5.3.2.jar:5.3.2]
    at org.springframework.web.client.RestTemplate.doExecute(RestTemplate.java:775) ~[spring-web-5.3.2.jar:5.3.2]
    at org.springframework.web.client.RestTemplate.exchange(RestTemplate.java:659) ~[spring-web-5.3.2.jar:5.3.2]
    at com.github.mkopylec.charon.forwarding.ReverseProxyFilter.doFilterInternal(ReverseProxyFilter.java:49) ~[charon-spring-webmvc-4.8.0.jar:na]
    at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:119) ~[spring-web-5.3.2.jar:5.3.2]
    at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:193) ~[tomcat-embed-core-9.0.41.jar:9.0.41]
    at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:166) ~[tomcat-embed-core-9.0.41.jar:9.0.41]
    at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:113) ~[spring-web-5.3.2.jar:5.3.2]
    at com.duplicateai.apigateway.auth.AlwaysJWTAuthFilter.doFilterInternal(AlwaysJWTAuthFilter.java:67) ~[classes/:na]
    at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:119) ~[spring-web-5.3.2.jar:5.3.2]
    at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:193) ~[tomcat-embed-core-9.0.41.jar:9.0.41]
    at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:166) ~[tomcat-embed-core-9.0.41.jar:9.0.41]
    at com.atlassian.connect.spring.internal.auth.jwt.JwtAuthenticationFilter.doFilterInternal(JwtAuthenticationFilter.java:82) ~[atlassian-connect-spring-boot-core-2.1.2.jar:na]
    at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:119) ~[spring-web-5.3.2.jar:5.3.2]
    at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:193) ~[tomcat-embed-core-9.0.41.jar:9.0.41]
    at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:166) ~[tomcat-embed-core-9.0.41.jar:9.0.41]
    at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:327) ~[spring-security-web-5.4.2.jar:5.4.2]
    at org.springframework.security.web.access.intercept.FilterSecurityInterceptor.invoke(FilterSecurityInterceptor.java:115) ~[spring-security-web-5.4.2.jar:5.4.2]
    at org.springframework.security.web.access.intercept.FilterSecurityInterceptor.doFilter(FilterSecurityInterceptor.java:81) ~[spring-security-web-5.4.2.jar:5.4.2]
    at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:336) ~[spring-security-web-5.4.2.jar:5.4.2]
    at org.springframework.security.web.access.ExceptionTranslationFilter.doFilter(ExceptionTranslationFilter.java:119) ~[spring-security-web-5.4.2.jar:5.4.2]
    at org.springframework.security.web.access.ExceptionTranslationFilter.doFilter(ExceptionTranslationFilter.java:113) ~[spring-security-web-5.4.2.jar:5.4.2]
    at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:336) ~[spring-security-web-5.4.2.jar:5.4.2]
    at org.springframework.security.web.session.SessionManagementFilter.doFilter(SessionManagementFilter.java:126) ~[spring-security-web-5.4.2.jar:5.4.2]
    at org.springframework.security.web.session.SessionManagementFilter.doFilter(SessionManagementFilter.java:81) ~[spring-security-web-5.4.2.jar:5.4.2]
    at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:336) ~[spring-security-web-5.4.2.jar:5.4.2]
    at org.springframework.security.web.authentication.AnonymousAuthenticationFilter.doFilter(AnonymousAuthenticationFilter.java:105) ~[spring-security-web-5.4.2.jar:5.4.2]
    at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:336) ~[spring-security-web-5.4.2.jar:5.4.2]
    at org.springframework.security.web.servletapi.SecurityContextHolderAwareRequestFilter.doFilter(SecurityContextHolderAwareRequestFilter.java:149) ~[spring-security-web-5.4.2.jar:5.4.2]
    at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:336) ~[spring-security-web-5.4.2.jar:5.4.2]
    at org.springframework.security.web.savedrequest.RequestCacheAwareFilter.doFilter(RequestCacheAwareFilter.java:63) ~[spring-security-web-5.4.2.jar:5.4.2]
    at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:336) ~[spring-security-web-5.4.2.jar:5.4.2]
    at org.springframework.security.web.authentication.www.BasicAuthenticationFilter.doFilterInternal(BasicAuthenticationFilter.java:149) ~[spring-security-web-5.4.2.jar:5.4.2]
    at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:119) ~[spring-web-5.3.2.jar:5.3.2]
    at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:336) ~[spring-security-web-5.4.2.jar:5.4.2]
    at org.springframework.security.web.authentication.logout.LogoutFilter.doFilter(LogoutFilter.java:103) ~[spring-security-web-5.4.2.jar:5.4.2]
    at org.springframework.security.web.authentication.logout.LogoutFilter.doFilter(LogoutFilter.java:89) ~[spring-security-web-5.4.2.jar:5.4.2]
    at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:336) ~[spring-security-web-5.4.2.jar:5.4.2]
    at org.springframework.security.web.header.HeaderWriterFilter.doHeadersAfter(HeaderWriterFilter.java:90) ~[spring-security-web-5.4.2.jar:5.4.2]
    at org.springframework.security.web.header.HeaderWriterFilter.doFilterInternal(HeaderWriterFilter.java:75) ~[spring-security-web-5.4.2.jar:5.4.2]
    at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:119) ~[spring-web-5.3.2.jar:5.3.2]
    at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:336) ~[spring-security-web-5.4.2.jar:5.4.2]
    at org.springframework.security.web.context.SecurityContextPersistenceFilter.doFilter(SecurityContextPersistenceFilter.java:110) ~[spring-security-web-5.4.2.jar:5.4.2]
    at org.springframework.security.web.context.SecurityContextPersistenceFilter.doFilter(SecurityContextPersistenceFilter.java:80) ~[spring-security-web-5.4.2.jar:5.4.2]
    at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:336) ~[spring-security-web-5.4.2.jar:5.4.2]
    at org.springframework.security.web.context.request.async.WebAsyncManagerIntegrationFilter.doFilterInternal(WebAsyncManagerIntegrationFilter.java:55) ~[spring-security-web-5.4.2.jar:5.4.2]
    at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:119) ~[spring-web-5.3.2.jar:5.3.2]
    at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:336) ~[spring-security-web-5.4.2.jar:5.4.2]
    at org.springframework.security.web.FilterChainProxy.doFilterInternal(FilterChainProxy.java:211) ~[spring-security-web-5.4.2.jar:5.4.2]
    at org.springframework.security.web.FilterChainProxy.doFilter(FilterChainProxy.java:183) ~[spring-security-web-5.4.2.jar:5.4.2]
    at org.springframework.web.filter.DelegatingFilterProxy.invokeDelegate(DelegatingFilterProxy.java:358) ~[spring-web-5.3.2.jar:5.3.2]
    at org.springframework.web.filter.DelegatingFilterProxy.doFilter(DelegatingFilterProxy.java:271) ~[spring-web-5.3.2.jar:5.3.2]
    at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:193) ~[tomcat-embed-core-9.0.41.jar:9.0.41]
    at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:166) ~[tomcat-embed-core-9.0.41.jar:9.0.41]
    at org.springframework.web.filter.RequestContextFilter.doFilterInternal(RequestContextFilter.java:100) ~[spring-web-5.3.2.jar:5.3.2]
    at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:119) ~[spring-web-5.3.2.jar:5.3.2]
    at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:193) ~[tomcat-embed-core-9.0.41.jar:9.0.41]
    at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:166) ~[tomcat-embed-core-9.0.41.jar:9.0.41]
    at org.springframework.web.filter.FormContentFilter.doFilterInternal(FormContentFilter.java:93) ~[spring-web-5.3.2.jar:5.3.2]
    at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:119) ~[spring-web-5.3.2.jar:5.3.2]
    at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:193) ~[tomcat-embed-core-9.0.41.jar:9.0.41]
    at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:166) ~[tomcat-embed-core-9.0.41.jar:9.0.41]
    at org.springframework.boot.actuate.metrics.web.servlet.WebMvcMetricsFilter.doFilterInternal(WebMvcMetricsFilter.java:93) ~[spring-boot-actuator-2.4.1.jar:2.4.1]
    at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:119) ~[spring-web-5.3.2.jar:5.3.2]
    at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:193) ~[tomcat-embed-core-9.0.41.jar:9.0.41]
    at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:166) ~[tomcat-embed-core-9.0.41.jar:9.0.41]
    at org.springframework.web.filter.CharacterEncodingFilter.doFilterInternal(CharacterEncodingFilter.java:201) ~[spring-web-5.3.2.jar:5.3.2]
    at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:119) ~[spring-web-5.3.2.jar:5.3.2]
    at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:193) ~[tomcat-embed-core-9.0.41.jar:9.0.41]
    at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:166) ~[tomcat-embed-core-9.0.41.jar:9.0.41]
    at org.apache.catalina.core.StandardWrapperValve.invoke(StandardWrapperValve.java:202) ~[tomcat-embed-core-9.0.41.jar:9.0.41]
    at org.apache.catalina.core.StandardContextValve.invoke(StandardContextValve.java:97) ~[tomcat-embed-core-9.0.41.jar:9.0.41]
    at org.apache.catalina.authenticator.AuthenticatorBase.invoke(AuthenticatorBase.java:542) ~[tomcat-embed-core-9.0.41.jar:9.0.41]
    at org.apache.catalina.core.StandardHostValve.invoke(StandardHostValve.java:143) ~[tomcat-embed-core-9.0.41.jar:9.0.41]
    at org.apache.catalina.valves.ErrorReportValve.invoke(ErrorReportValve.java:92) ~[tomcat-embed-core-9.0.41.jar:9.0.41]
    at org.apache.catalina.core.StandardEngineValve.invoke(StandardEngineValve.java:78) ~[tomcat-embed-core-9.0.41.jar:9.0.41]
    at org.apache.catalina.connector.CoyoteAdapter.service(CoyoteAdapter.java:343) ~[tomcat-embed-core-9.0.41.jar:9.0.41]
    at org.apache.coyote.http11.Http11Processor.service(Http11Processor.java:374) ~[tomcat-embed-core-9.0.41.jar:9.0.41]
    at org.apache.coyote.AbstractProcessorLight.process(AbstractProcessorLight.java:65) ~[tomcat-embed-core-9.0.41.jar:9.0.41]
    at org.apache.coyote.AbstractProtocol$ConnectionHandler.process(AbstractProtocol.java:888) ~[tomcat-embed-core-9.0.41.jar:9.0.41]
    at org.apache.tomcat.util.net.NioEndpoint$SocketProcessor.doRun(NioEndpoint.java:1597) ~[tomcat-embed-core-9.0.41.jar:9.0.41]
    at org.apache.tomcat.util.net.SocketProcessorBase.run(SocketProcessorBase.java:49) ~[tomcat-embed-core-9.0.41.jar:9.0.41]
    at java.base/java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1130) ~[na:na]
    at java.base/java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:630) ~[na:na]
    at org.apache.tomcat.util.threads.TaskThread$WrappingRunnable.run(TaskThread.java:61) ~[tomcat-embed-core-9.0.41.jar:9.0.41]
    at java.base/java.lang.Thread.run(Thread.java:832) ~[na:na]

I believe blanks in URIs should be supported. Can you help?

mkopylec commented 3 years ago

Can you provide some RFC or similar to ensure that white spaces are allowed in URL paths?

mararn1618 commented 3 years ago

Of course: https://tools.ietf.org/html/rfc3986#section-2.1 states that URIs may include percentage espaped characters and uses %20 as an example.

Just want to point out that I have added another Interceptor on top. I can verify that in my case the URI has %20-encoding before reaching com.github.mkopylec.charon.forwarding.interceptors.HttpRequestInterceptor.

Is it decoded and passed to UriComponentsBuilder?

mararn1618 commented 3 years ago

CommonRegexRequestPathRewriter decodes the URL with URI.getPath() and I assume characters are not encoded again.

image

Edit: The URI rewrittenURI needs to be built differently. The rewrittenPath (flawed according to RFC, since it allows illegal characters after being decoded before). We need to encode before or build differently.

image

Hope my debugging helps.

mkopylec commented 3 years ago

Fixed in 4.9.0

mararn1618 commented 3 years ago

Excited - Can't wait to test, hope I get the chance in the next days.

mararn1618 commented 3 years ago

Works like a charm. Thank you.

image

mkopylec commented 3 years ago

Great!