Added allowed url property to URLContextClassLoaderFactory

core/src/main/java/org/apache/accumulo/core/classloader/ClassLoaderUtil.java

@@ -47,6 +47,7 @@ public static synchronized void initContextFactory(AccumuloConfiguration conf) {
         LOG.info("Using default {}, which is subject to change in a future release",
             ContextClassLoaderFactory.class.getName());
         FACTORY = new URLContextClassLoaderFactory();
+        FACTORY.init(() -> new ConfigurationImpl(conf));
       } else {
         // load user's selected implementation and provide it with the service environment
         try {

core/src/main/java/org/apache/accumulo/core/classloader/URLContextClassLoaderFactory.java

@@ -18,16 +18,25 @@
  */
 package org.apache.accumulo.core.classloader;
 
+import static com.google.common.base.Preconditions.checkArgument;
+
+import java.io.IOException;
 import java.io.UncheckedIOException;
-import java.net.MalformedURLException;
 import java.net.URI;
+import java.net.URISyntaxException;
 import java.net.URL;
 import java.net.URLClassLoader;
+import java.nio.file.Path;
 import java.util.Arrays;
+import java.util.regex.Pattern;
 
+import org.apache.accumulo.core.conf.Property;
+import org.apache.accumulo.core.spi.common.ContextClassLoaderEnvironment;
 import org.apache.accumulo.core.spi.common.ContextClassLoaderFactory;
 import org.apache.accumulo.core.util.cache.Caches;
 import org.apache.accumulo.core.util.cache.Caches.CacheName;
+import org.apache.hadoop.conf.Configuration;
+import org.apache.hadoop.fs.FileSystem;
 import org.slf4j.Logger;
 import org.slf4j.LoggerFactory;
 
@@ -42,26 +51,80 @@ public class URLContextClassLoaderFactory implements ContextClassLoaderFactory {
 
   private static final Logger LOG = LoggerFactory.getLogger(URLContextClassLoaderFactory.class);
 
+  public static final String URL_PATTERN_PROPERTY =
+      Property.GENERAL_ARBITRARY_PROP_PREFIX + "factory.class.loader.url.allowed.patterns";
+
+  private static final Pattern ENCODED_PATH_TRAVERSAL = Pattern.compile("(?i)%(?:25|2e|2f|5c)");
+
   // Cache the class loaders for re-use
   // WeakReferences are used so that the class loaders can be cleaned up when no longer needed
   // Classes that are loaded contain a reference to the class loader used to load them
   // so the class loader will be garbage collected when no more classes are loaded that reference it
   private final Cache<String,URLClassLoader> classloaders =
       Caches.getInstance().createNewBuilder(CacheName.CLASSLOADERS, true).weakValues().build();
 
+  private volatile Pattern urlPattern = null;
+
   @Override
-  public ClassLoader getClassLoader(String context) {
+  public void init(ContextClassLoaderEnvironment env) {
+    String urlPatternProperty = env.getConfiguration().get(URL_PATTERN_PROPERTY);
+    if (urlPatternProperty == null) {
+      LOG.warn("Property " + URL_PATTERN_PROPERTY + " not set, no contexts are allowed");
+    } else {
+      urlPattern =
+          Pattern.compile(urlPatternProperty.replaceAll(":///", ":/").replaceAll("://", ":/"));
+    }
+  }
+
+  // visible for tests
+  protected URL testContextAgainstPattern(String context) throws IOException, URISyntaxException {
+    final URI uri = new URI(context).normalize();
+    URL url;
+    if ("file".equalsIgnoreCase(uri.getScheme())) {
+      // Match and return the actual filesystem target, not the possibly traversing URL spelling.
+      // toRealPath also resolves symbolic links, so an allowed path cannot escape via a symlink.
+      Path realPath = Path.of(uri).toRealPath();
+      url = realPath.toUri().toURL();
+    } else if ("hdfs".equalsIgnoreCase(uri.getScheme())) {
+      // Match and return the actual filesystem target, not the possibly traversing URL spelling.
+      // resolvePath also resolves symbolic links, so an allowed path cannot escape via a symlink.
+      // This may subsequently fail if the HdfsURLStreamHandlerProvider is not on the classpath
+      org.apache.hadoop.fs.Path resolved =
+          FileSystem.get(uri, new Configuration()).resolvePath(new org.apache.hadoop.fs.Path(uri));
+      url = resolved.toUri().toURL();
+    } else {
+      String rawPath = uri.getRawPath();
+      checkArgument(rawPath == null || !ENCODED_PATH_TRAVERSAL.matcher(rawPath).find(),
+          "Context %s contains encoded path traversal characters in URL path (%s)", context,
+          rawPath);
+      url = uri.toURL();
+    }
+    checkArgument(urlPattern.matcher(url.toExternalForm()).matches(),
+        "Context %s URL (%s) not allowed by pattern (%s)", context, url.toExternalForm(),
+        urlPattern.pattern());
+    return url;
+  }
+
+  @Override
+  public ClassLoader getClassLoader(String context) throws ContextClassLoaderException {
+    if (urlPattern == null) {
+      throw new ContextClassLoaderException(
+          "Property " + URL_PATTERN_PROPERTY + " not set, no contexts are allowed");
+    }
+
     if (context == null) {
       throw new IllegalArgumentException("Unknown context");
     }
 
     return classloaders.get(context, k -> {
       LOG.debug("Creating URLClassLoader for context, uris: {}", context);
-      return new URLClassLoader(Arrays.stream(context.split(",")).map(p -> {
+      return new URLClassLoader(Arrays.stream(context.split(",")).map(ctx -> {
         try {
-          return URI.create(p).toURL();
-        } catch (MalformedURLException e) {
+          return testContextAgainstPattern(ctx);
+        } catch (IOException e) {
           throw new UncheckedIOException(e);
+        } catch (URISyntaxException e) {
+          throw new IllegalArgumentException(e);
         }
       }).toArray(URL[]::new), ClassLoader.getSystemClassLoader());
     });

core/src/test/java/org/apache/accumulo/core/classloader/ContextClassLoaderFactoryTest.java

@@ -19,7 +19,10 @@
 package org.apache.accumulo.core.classloader;
 
 import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertThrows;
+import static org.junit.jupiter.api.Assertions.assertTrue;
 
+import java.net.MalformedURLException;
 import java.net.URL;
 import java.net.URLClassLoader;
 import java.nio.file.Files;
@@ -37,14 +40,16 @@
 
 import edu.umd.cs.findbugs.annotations.SuppressFBWarnings;
 
-@SuppressFBWarnings(value = "PATH_TRAVERSAL_IN", justification = "paths not set by user input")
+@SuppressFBWarnings(value = {"PATH_TRAVERSAL_IN", "NP_NULL_ON_SOME_PATH_FROM_RETURN_VALUE"},
+    justification = "paths not set by user input")
 public class ContextClassLoaderFactoryTest extends WithTestNames {
 
   @TempDir
   private static Path tempFolder;
 
   private URL uri1;
   private URL uri2;
+  private String tempFolderPattern;
 
   @BeforeEach
   public void setup() throws Exception {
@@ -70,6 +75,41 @@ public void setup() throws Exception {
         propsFile2.toFile());
     uri2 = propsFile2.toUri().toURL();
 
+    tempFolderPattern = tempFolder.toUri().toURL().toExternalForm() + ".*";
+  }
+
+  @Test
+  public void urlContextPatternNotSet() {
+    ConfigurationCopy cc = new ConfigurationCopy();
+    cc.set(Property.GENERAL_CONTEXT_CLASSLOADER_FACTORY.getKey(),
+        URLContextClassLoaderFactory.class.getName());
+    ClassLoaderUtil.resetContextFactoryForTests();
+    ClassLoaderUtil.initContextFactory(cc);
+    ContextClassLoaderException ex = assertThrows(ContextClassLoaderException.class, () -> {
+      @SuppressWarnings("unused")
+      URLClassLoader classloader =
+          (URLClassLoader) ClassLoaderUtil.getContextFactory().getClassLoader(uri1.toString());
+    });
+    assertEquals(
+        "Error getting classloader for context: Property general.custom.factory.class.loader.url.allowed.patterns not set, no contexts are allowed",
+        ex.getMessage());
+  }
+
+  @Test
+  public void urlContextPatternDoesNotMath() throws MalformedURLException {
+    ConfigurationCopy cc = new ConfigurationCopy();
+    cc.set(Property.GENERAL_CONTEXT_CLASSLOADER_FACTORY.getKey(),
+        URLContextClassLoaderFactory.class.getName());
+    cc.set(URLContextClassLoaderFactory.URL_PATTERN_PROPERTY,
+        new URL("file:///path/to/unknown/folder/.*").toExternalForm());
+    ClassLoaderUtil.resetContextFactoryForTests();
+    ClassLoaderUtil.initContextFactory(cc);
+    IllegalArgumentException ex = assertThrows(IllegalArgumentException.class, () -> {
+      @SuppressWarnings("unused")
+      URLClassLoader classloader =
+          (URLClassLoader) ClassLoaderUtil.getContextFactory().getClassLoader(uri1.toString());
+    });
+    assertTrue(ex.getMessage().contains(" not allowed by pattern "));
   }
 
   @Test
@@ -78,6 +118,7 @@ public void differentContexts() throws ContextClassLoaderException {
     ConfigurationCopy cc = new ConfigurationCopy();
     cc.set(Property.GENERAL_CONTEXT_CLASSLOADER_FACTORY.getKey(),
         URLContextClassLoaderFactory.class.getName());
+    cc.set(URLContextClassLoaderFactory.URL_PATTERN_PROPERTY, tempFolderPattern);
     ClassLoaderUtil.resetContextFactoryForTests();
     ClassLoaderUtil.initContextFactory(cc);
 

core/src/test/java/org/apache/accumulo/core/classloader/URLContextClassLoaderFactoryTest.java

@@ -0,0 +1,101 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *   https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied.  See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+package org.apache.accumulo.core.classloader;
+
+import static org.junit.jupiter.api.Assertions.assertEquals;
+import static org.junit.jupiter.api.Assertions.assertNotNull;
+import static org.junit.jupiter.api.Assertions.assertThrows;
+import static org.junit.jupiter.api.Assertions.assertTrue;
+
+import java.io.IOException;
+import java.net.URL;
+import java.nio.file.Files;
+import java.nio.file.Path;
+import java.util.Map;
+
+import org.apache.accumulo.core.spi.common.ContextClassLoaderEnvironment;
+import org.apache.accumulo.core.spi.common.ServiceEnvironment.Configuration;
+import org.junit.jupiter.api.Test;
+import org.junit.jupiter.api.io.TempDir;
+
+public class URLContextClassLoaderFactoryTest {
+
+  @Test
+  public void test(@TempDir Path tempDir) throws Exception {
+    Path allowedDir = tempDir.resolve("allowed");
+    Path allowedJars = allowedDir.resolve("application_jars");
+    Files.createDirectories(allowedJars);
+    Path allowedJar = Files.createFile(allowedJars.resolve("allowed.jar"));
+    Path outsideJar = Files.createFile(tempDir.resolve("outside.jar"));
+
+    String allowedFilePattern = allowedDir.toUri().toURL().toExternalForm() + ".*";
+    URLContextClassLoaderFactory factory =
+        factoryForPattern(allowedFilePattern + "|http://path/b/.*");
+
+    // Existing allowed files pass, including paths with literal dot segments that normalize
+    // to an allowed file.
+    URL expectedCanonicalUrl = allowedJar.toRealPath().toUri().toURL();
+    assertEquals(expectedCanonicalUrl,
+        factory.testContextAgainstPattern(allowedJar.toUri().toString()));
+    assertEquals(expectedCanonicalUrl, factory.testContextAgainstPattern(
+        allowedDir.toUri().toString() + "application_jars/../application_jars/allowed.jar"));
+    assertThrows(IOException.class, () -> factory
+        .testContextAgainstPattern(allowedJars.resolve("missing.jar").toUri().toString()));
+
+    // Traversal that resolves outside the allowed directory is rejected, whether written
+    // literally, percent-encoded, or reached through a symlink.
+    assertThrows(IllegalArgumentException.class,
+        () -> factory.testContextAgainstPattern(allowedDir.toUri() + "../outside.jar"));
+    assertThrows(IllegalArgumentException.class,
+        () -> factory.testContextAgainstPattern(allowedDir.toUri() + "%2e%2e/outside.jar"));
+    Path symlink = Files.createSymbolicLink(allowedDir.resolve("escape.jar"), outsideJar);
+    assertThrows(IllegalArgumentException.class,
+        () -> factory.testContextAgainstPattern(symlink.toUri().toString()));
+
+    // HTTP URLs retain literal dot-segment normalization, but encoded path delimiters, dots, and
+    // percent escapes that could be double-decoded are rejected as ambiguous.
+    assertNotNull(factory.testContextAgainstPattern("http:///path/b/application_jars/.*"));
+    assertNotNull(factory.testContextAgainstPattern("http:/path/c/../b/application_jars/.*"));
+    IllegalArgumentException iae = assertThrows(IllegalArgumentException.class,
+        () -> factory.testContextAgainstPattern("http:///path/b/%2e%2e/c/application_jars/.*"));
+    assertTrue(iae.getMessage().contains("encoded path traversal"));
+    assertThrows(IllegalArgumentException.class,
+        () -> factory.testContextAgainstPattern("http:///path/b/%2f../c/application_jars/.*"));
+    assertThrows(IllegalArgumentException.class,
+        () -> factory.testContextAgainstPattern("http:///path/b/%252e%252e/c/application_jars/.*"));
+
+    iae = assertThrows(IllegalArgumentException.class,
+        () -> factory.testContextAgainstPattern("http:///path/a/application_jars/.*"));
+    assertTrue(iae.getMessage().contains("not allowed by pattern"));
+  }
+
+  private URLContextClassLoaderFactory factoryForPattern(String pattern) {
+    URLContextClassLoaderFactory factory = new URLContextClassLoaderFactory();
+    factory.init(new ContextClassLoaderEnvironment() {
+
+      @Override
+      public Configuration getConfiguration() {
+        return Configuration
+            .from(Map.of(URLContextClassLoaderFactory.URL_PATTERN_PROPERTY, pattern), false);
+      }
+
+    });
+    return factory;
+  }
+}

minicluster/src/test/java/org/apache/accumulo/minicluster/MiniAccumuloClusterClasspathTest.java

@@ -28,6 +28,7 @@
 import java.util.Map;
 import java.util.Map.Entry;
 
+import org.apache.accumulo.core.classloader.URLContextClassLoaderFactory;
 import org.apache.accumulo.core.client.Accumulo;
 import org.apache.accumulo.core.client.AccumuloClient;
 import org.apache.accumulo.core.client.BatchWriter;
@@ -74,6 +75,8 @@ public static void setupMiniCluster() throws Exception {
     config.setZooKeeperPort(0);
     HashMap<String,String> site = new HashMap<>();
     site.put(Property.TSERV_WAL_MAX_SIZE.getKey(), "1G");
+    site.put(URLContextClassLoaderFactory.URL_PATTERN_PROPERTY,
+        jarFile.toURI().toURL().toExternalForm());
     config.setSiteConfig(site);
     accumulo = new MiniAccumuloCluster(config);
     accumulo.start();
@@ -93,8 +96,8 @@ public void testPerTableClasspath() throws Exception {
       final String tableName = testName();
 
       var ntc = new NewTableConfiguration();
-      ntc.setProperties(
-          Map.of(Property.TABLE_CLASSLOADER_CONTEXT.getKey(), jarFile.toURI().toString()));
+      ntc.setProperties(Map.of(Property.TABLE_CLASSLOADER_CONTEXT.getKey(),
+          jarFile.toURI().toURL().toExternalForm()));
       ntc.attachIterator(
           new IteratorSetting(100, "foocensor", "org.apache.accumulo.test.FooFilter"));
 

test/src/main/java/org/apache/accumulo/test/compaction/ClassLoaderContextCompactionIT.java

@@ -31,6 +31,7 @@
 import static org.junit.jupiter.api.Assertions.assertNotNull;
 import static org.junit.jupiter.api.Assertions.assertTrue;
 
+import java.net.MalformedURLException;
 import java.net.URL;
 import java.util.EnumSet;
 import java.util.List;
@@ -39,6 +40,7 @@
 import java.util.concurrent.atomic.AtomicBoolean;
 import java.util.concurrent.atomic.AtomicLong;
 
+import org.apache.accumulo.core.classloader.URLContextClassLoaderFactory;
 import org.apache.accumulo.core.client.Accumulo;
 import org.apache.accumulo.core.client.AccumuloClient;
 import org.apache.accumulo.core.client.IteratorSetting;
@@ -95,6 +97,13 @@ public static void after() throws Exception {
   @Override
   public void configureMiniCluster(MiniAccumuloConfigImpl cfg, Configuration coreSite) {
     ExternalCompactionTestUtils.configureMiniCluster(cfg, coreSite);
+    try {
+      cfg.setProperty(URLContextClassLoaderFactory.URL_PATTERN_PROPERTY,
+          new URL("file:" + cfg.getDir().toString() + "/accumulo/classpath/.*").toExternalForm());
+    } catch (MalformedURLException e) {
+      throw new RuntimeException(e);
+    }
+
     // After 1 failure start backing off by 5s.
     // After 3 failures, terminate the Compactor
     cfg.setProperty(Property.COMPACTOR_FAILURE_BACKOFF_THRESHOLD, "1");
@@ -220,7 +229,7 @@ public void testClassLoaderContextErrorKillsCompactor() throws Exception {
 
       // Set the context on the table
       client.tableOperations().setProperty(table1, Property.TABLE_CLASSLOADER_CONTEXT.getKey(),
-          dst.toUri().toString());
+          dst.toUri().toURL().toExternalForm());
 
       final IteratorSetting cfg =
           new IteratorSetting(101, "FooFilter", "org.apache.accumulo.test.FooFilter");