[SLING-11776] Sling ResourceMerger may cause high cpu utilization

• Type: Bug
• Status: Closed
• Priority: Major
• Resolution: Fixed
• Affects Version/s: Resource Merger 1.4.0
• Fix Version/s: Resource Merger 1.4.2
• Component/s: Extensions
• Assignee: Carsten Ziegeler
• Reporter: Sagar Miglani
• Created: 16/Feb/23 09:04
• Updated: 17/Mar/23 15:02
• Resolved: 16/Feb/23 16:20

Description

If a bogus path like the following is used, resource merger can consume high amount of CPU and may lead to Denial of Service:

/mnt/override/mnt/override/mnt/override/mnt/override/mnt/override/mnt/override/mnt/override/mnt/override/mnt/override/mnt/override/mnt/override/mnt/override/mnt/override/mnt/override

Steps to reproduce

1. Spawn an AEM author instance and login
2. Open
   http://localhost:4502/aem/start.html//mnt/override/mnt/override/mnt/override/mnt/override/mnt/override/mnt/override/mnt/override/mnt/override/mnt/override/mnt/override/mnt/override/mnt/override/mnt/override/mnt/override
   OR use
   curl -u <user>:<pass> http://localhost:4502/aem/start.html//mnt/override/mnt/override/mnt/override/mnt/override/mnt/override/mnt/override/mnt/override/mnt/override/mnt/override/mnt/override/mnt/override/mnt/override/mnt/override/mnt/override

In MergingResourceProvider, we are calculating the relative path, which is just removing the merge root path from from the actual path.
And this relative path is used for finding the resources under it.
eg: if path is /mnt/override/mnt/override/mnt/override/bin then relative path will be /mnt/override/mnt/override
And because this relative path again starts with /mnt/override again MergingResourceProvider will be picked and same calls will be executed.