KNOX-3418: Path traversal → arbitrary file write/overwrite in the Apa…

[hanicz]

…che Knox Admin API

KNOX-3418 - Path traversal → arbitrary file write/overwrite in the Apache Knox Admin API

What changes were proposed in this pull request?

1. Path traversal in resource-management upload endpoints

PUT /admin/api/v1/{providerconfig,descriptors,topologies}/{name} let an admin-role user write files outside the managed shared-providers/descriptors/topologies directories with an attacker-chosen name and extension (e.g. overwriting conf/gateway-site.xml).

• TopologiesResource — tightened the pattern to ^[\w.-]+$ (no /), made isValidResourceName also reject any name containing .., removed redundant URLDecoder.decode from all three handlers. The name/id is already decoded at this point by Jetty
• DefaultTopologyService — canonical-path containment guards at the writeConfig and deployTopology sinks.
• ZkRemoteConfigurationMonitorService — createProvider/createDescriptor strip directory components via FilenameUtils.getName() before building the znode path.

2. Read-only topology override bypass

Topologies marked read-only via gateway.read.only.override.topologies are blocked in the UI, but PUT /admin/api/v1/topologies/{id} never consulted that list — it only guarded against descriptor-generated topologies (isGenerated()), which read-only-override topologies are not.

• TopologiesResource.uploadTopology — before deploying, refuse if the name is in getReadOnlyOverrideTopologyNames(), throwing 403 FORBIDDEN.

New unit tests

How was this patch tested?

Tested Admin UI after the changes
Unit tests
Local admin API tests

<property>
  <name>gateway.read.only.override.topologies</name>
  <value>homepage</value>
</property>

curl -ivku admin:admin-password -H "Content-Type: application/xml" -d '<?xml version="1.0" encoding="UTF-8"?>
<topology>
   <uri>https://localhost:8443/gateway/sandbox</uri>
   <name>sandbox</name>
   <timestamp>1579705815000</timestamp>
   <generated>false</generated>
   <redeployTime>0</redeployTime>
   <gateway>
      <provider>
         <role>identity-assertion</role>
         <name>Default</name>
         <enabled>true</enabled>
      </provider>
   </gateway>
   <service>
      <role>NAMENODE</role>
      <url>hdfs://localhost:8020</url>
   </service>
</topology>'  -X PUT 'https://localhost:8443/gateway/newmanager/api/v1/topologies/sandbox'

Before HTTP/1.1 200 OK

After:

HTTP/1.1 403 Forbidden
{ "error" : "Cannot overwrite read-only topology: homepage" }

curl -ivku admin:admin-password -H "Content-Type: application/json" -d "<configuration> ...your chosen content... </configuration>"  -X PUT 'https://localhost:8443/gateway/newmanager/api/v1/providerconfig/..%252fgateway-site.xml'
ERROR knox.gateway (TopologiesResource.java:uploadProviderConfiguration(334)) - Invalid resource name: ..%2fgateway-site.xml

curl -ivku admin:admin-password -H "Content-Type: application/json" -d "<configuration> ...your chosen content... </configuration>"  -X PUT 'https://localhost:8443/gateway/newmanager/api/v1/providerconfig/..%2fgateway-site.xml'
ERROR knox.gateway (TopologiesResource.java:uploadProviderConfiguration(334)) - Invalid resource name: ../gateway-site.xml

Integration Tests

N/A

UI changes

N/A

[github-actions]

Test Results

40 tests   40 ✅  6s ⏱️
 3 suites   0 💤
 3 files     0 ❌

Results for commit 30d3ed7.

♻️ This comment has been updated with latest results.