[jboss-jira] [JBoss JIRA] (WFLY-3969) HeaderTokenParser doesn't parse correctly values which includes a quote

[Josef Cacek (JIRA)]

     [ https://issues.jboss.org/browse/WFLY-3969?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ]

Josef Cacek updated WFLY-3969:
------------------------------
    Steps to Reproduce: 
# allow plain passwords for management realm authentication & reload server
{code}
bin/jboss-cli.sh -c <<EOT
/core-service=management/security-realm=ManagementRealm/authentication=properties:write-attribute(name=plain-text,value=true)
reload
EOT
{code}
# add the new user to mgmt-users.properties
{code}
echo 'a"b=anil' >> standalone/configuration/mgmt-users.properties
{code}
# try to authenticate to HTTP management interface e.g.
http://127.0.0.1:9990/management?operation=attribute&name=server-state
and use following credentials:
Username: a"b
Password: anil

Results in failed authentication. Log file contains:
{code}
java.lang.IllegalArgumentException: UT000025: Unexpected token 'b", realm' within header.
	at io.undertow.util.HeaderTokenParser.parseHeader(HeaderTokenParser.java:67)
	at io.undertow.security.impl.DigestAuthorizationToken.parseHeader(DigestAuthorizationToken.java:79)
	at io.undertow.security.impl.DigestAuthenticationMechanism.authenticate(DigestAuthenticationMechanism.java:144)
	at org.jboss.as.domain.http.server.security.AuthenticationMechanismWrapper.authenticate(AuthenticationMechanismWrapper.java:57)
	at io.undertow.security.impl.SecurityContextImpl$AuthAttempter.transition(SecurityContextImpl.java:281)
	at io.undertow.security.impl.SecurityContextImpl$AuthAttempter.transition(SecurityContextImpl.java:298)
	at io.undertow.security.impl.SecurityContextImpl$AuthAttempter.access$100(SecurityContextImpl.java:268)
	at io.undertow.security.impl.SecurityContextImpl.attemptAuthentication(SecurityContextImpl.java:131)
	at io.undertow.security.impl.SecurityContextImpl.authTransition(SecurityContextImpl.java:106)
	at io.undertow.security.impl.SecurityContextImpl.authenticate(SecurityContextImpl.java:99)
	at io.undertow.security.handlers.AuthenticationCallHandler.handleRequest(AuthenticationCallHandler.java:50)
	at io.undertow.server.Connectors.executeRootHandler(Connectors.java:197)
	at io.undertow.server.HttpServerExchange$1.run(HttpServerExchange.java:737)
	at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1145)
	at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:615)
	at java.lang.Thread.run(Thread.java:745)
{code}

  was:
# allow plain passwords & reload server
{code}
bin/jboss-cli.sh -c <<EOT
/core-service=management/security-realm=ManagementRealm/authentication=properties:write-attribute(name=plain-text,value=true)
reload
EOT
{code}
# add the new user to mgmt-users.properties
{code}
echo 'a"b=anil' >> standalone/configuration/mgmt-users.properties
{code}
# try to authenticate to HTTP management interface e.g.
http://127.0.0.1:9990/management?operation=attribute&name=server-state
and use following credentials:
Username: a"b
Password: anil

Results in failed authentication. Log file contains:
{code}
java.lang.IllegalArgumentException: UT000025: Unexpected token 'b", realm' within header.
	at io.undertow.util.HeaderTokenParser.parseHeader(HeaderTokenParser.java:67)
	at io.undertow.security.impl.DigestAuthorizationToken.parseHeader(DigestAuthorizationToken.java:79)
	at io.undertow.security.impl.DigestAuthenticationMechanism.authenticate(DigestAuthenticationMechanism.java:144)
	at org.jboss.as.domain.http.server.security.AuthenticationMechanismWrapper.authenticate(AuthenticationMechanismWrapper.java:57)
	at io.undertow.security.impl.SecurityContextImpl$AuthAttempter.transition(SecurityContextImpl.java:281)
	at io.undertow.security.impl.SecurityContextImpl$AuthAttempter.transition(SecurityContextImpl.java:298)
	at io.undertow.security.impl.SecurityContextImpl$AuthAttempter.access$100(SecurityContextImpl.java:268)
	at io.undertow.security.impl.SecurityContextImpl.attemptAuthentication(SecurityContextImpl.java:131)
	at io.undertow.security.impl.SecurityContextImpl.authTransition(SecurityContextImpl.java:106)
	at io.undertow.security.impl.SecurityContextImpl.authenticate(SecurityContextImpl.java:99)
	at io.undertow.security.handlers.AuthenticationCallHandler.handleRequest(AuthenticationCallHandler.java:50)
	at io.undertow.server.Connectors.executeRootHandler(Connectors.java:197)
	at io.undertow.server.HttpServerExchange$1.run(HttpServerExchange.java:737)
	at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1145)
	at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:615)
	at java.lang.Thread.run(Thread.java:745)
{code}



> HeaderTokenParser doesn't parse correctly values which includes a quote
> -----------------------------------------------------------------------
>
>                 Key: WFLY-3969
>                 URL: https://issues.jboss.org/browse/WFLY-3969
>             Project: WildFly
>          Issue Type: Bug
>          Components: Web (Undertow)
>            Reporter: Josef Cacek
>            Assignee: Stuart Douglas
>            Priority: Critical
>
> The header parser doesn't work correctly if a parsed value contains quote character ("). The problem is, the parser is in phase of searching a LAST_QUOTE and it doesn't check if the found quote character is escaped or not.



--
This message was sent by Atlassian JIRA
(v6.3.1#6329)