Uploaded image for project: 'Tika'
  1. Tika
  2. TIKA-2081

Add back 'fileUrl' functionality to TikaJAXRS Server subject to security controls

    Details

    • Type: Task
    • Status: Resolved
    • Priority: Minor
    • Resolution: Fixed
    • Affects Version/s: 1.13
    • Fix Version/s: 2.0, 1.14
    • Component/s: server
    • Labels:
    • Environment:

      All versions

      Description

      Add back 'fileUrl' functionality from version 1.9 to TikaJAXRS Server subject to additional security controls:

      disable by default
      only enable if appropriate configuration flags are specified
      when enabled print warning displaying at least CVE ID: CVE-2015-3271.

      as discussed on dev@tika.apache.org mailing list under title "Query on correct use of 'fileUrl' in TikaJAXRS Server to extract document at remote url - my request is not working".

        Issue Links

          Activity

          Hide
          tallison@mitre.org Tim Allison added a comment - - edited

          I added fileUrl back. I didn't add any unit tests. If anyone has an idea of how we can do those safely, let me know.

          Following Konstantin Gribov's recommendation, the user has to include
          --enableUnsecureFeatures and --enableFileUrl on the commandline.

          Warnings abound. If anyone has a chance to review this commit, I'd appreciate it. I really don't like not adding unit tests...

          Show
          tallison@mitre.org Tim Allison added a comment - - edited I added fileUrl back. I didn't add any unit tests. If anyone has an idea of how we can do those safely, let me know. Following Konstantin Gribov 's recommendation, the user has to include --enableUnsecureFeatures and --enableFileUrl on the commandline. Warnings abound. If anyone has a chance to review this commit, I'd appreciate it. I really don't like not adding unit tests...
          Hide
          hudson Hudson added a comment -

          FAILURE: Integrated in Jenkins build tika-2.x-windows #53 (See https://builds.apache.org/job/tika-2.x-windows/53/)

          • Re-enable fileUrl for tika-server (TIKA-2081). If you choose, (tallison: rev ce1fc3720cdcd84b5523b14fc28fd2fb355c9ee2)
          • (add) tika-server/src/main/java/org/apache/tika/server/InputStreamFactory.java
          • (edit) tika-server/src/main/java/org/apache/tika/server/resource/RecursiveMetadataResource.java
          • (edit) tika-server/src/main/java/org/apache/tika/server/resource/TikaResource.java
          • (edit) tika-server/src/main/java/org/apache/tika/server/resource/MetadataResource.java
          • (edit) tika-server/src/test/java/org/apache/tika/server/CXFTestBase.java
          • (edit) tika-server/src/main/java/org/apache/tika/server/resource/DetectorResource.java
          • (add) tika-server/src/main/java/org/apache/tika/server/URLEnabledInputStreamFactory.java
          • (edit) tika-server/src/main/java/org/apache/tika/server/resource/UnpackerResource.java
          • (edit) CHANGES.txt
          • (add) tika-server/src/main/java/org/apache/tika/server/DefaultInputStreamFactory.java
          • (edit) tika-server/src/main/java/org/apache/tika/server/TikaServerCli.java
          Show
          hudson Hudson added a comment - FAILURE: Integrated in Jenkins build tika-2.x-windows #53 (See https://builds.apache.org/job/tika-2.x-windows/53/ ) Re-enable fileUrl for tika-server ( TIKA-2081 ). If you choose, (tallison: rev ce1fc3720cdcd84b5523b14fc28fd2fb355c9ee2) (add) tika-server/src/main/java/org/apache/tika/server/InputStreamFactory.java (edit) tika-server/src/main/java/org/apache/tika/server/resource/RecursiveMetadataResource.java (edit) tika-server/src/main/java/org/apache/tika/server/resource/TikaResource.java (edit) tika-server/src/main/java/org/apache/tika/server/resource/MetadataResource.java (edit) tika-server/src/test/java/org/apache/tika/server/CXFTestBase.java (edit) tika-server/src/main/java/org/apache/tika/server/resource/DetectorResource.java (add) tika-server/src/main/java/org/apache/tika/server/URLEnabledInputStreamFactory.java (edit) tika-server/src/main/java/org/apache/tika/server/resource/UnpackerResource.java (edit) CHANGES.txt (add) tika-server/src/main/java/org/apache/tika/server/DefaultInputStreamFactory.java (edit) tika-server/src/main/java/org/apache/tika/server/TikaServerCli.java
          Hide
          hudson Hudson added a comment -

          SUCCESS: Integrated in Jenkins build Tika-trunk #1107 (See https://builds.apache.org/job/Tika-trunk/1107/)
          TIKA-2081 – add fileUrl back into tika-server (tallison: rev d612aea850060c7d77124f79c525f68032a11031)

          • (edit) tika-server/src/test/java/org/apache/tika/server/CXFTestBase.java
          • (edit) tika-server/src/main/java/org/apache/tika/server/resource/UnpackerResource.java
          • (edit) tika-server/src/main/java/org/apache/tika/server/resource/RecursiveMetadataResource.java
          • (edit) tika-server/src/main/java/org/apache/tika/server/resource/TikaResource.java
          • (edit) tika-server/src/main/java/org/apache/tika/server/resource/MetadataResource.java
          • (edit) tika-server/src/main/java/org/apache/tika/server/resource/DetectorResource.java
          • (add) tika-server/src/main/java/org/apache/tika/server/URLEnabledInputStreamFactory.java
          • (add) tika-server/src/main/java/org/apache/tika/server/DefaultInputStreamFactory.java
          • (add) tika-server/src/main/java/org/apache/tika/server/InputStreamFactory.java
          • (edit) tika-server/src/main/java/org/apache/tika/server/TikaServerCli.java
            TIKA-2081 – add fileUrl back into tika-server, update changes.txt (tallison: rev b58368f3f42f52adb76541b7a321e15bab5e04dc)
          • (edit) CHANGES.txt
          Show
          hudson Hudson added a comment - SUCCESS: Integrated in Jenkins build Tika-trunk #1107 (See https://builds.apache.org/job/Tika-trunk/1107/ ) TIKA-2081 – add fileUrl back into tika-server (tallison: rev d612aea850060c7d77124f79c525f68032a11031) (edit) tika-server/src/test/java/org/apache/tika/server/CXFTestBase.java (edit) tika-server/src/main/java/org/apache/tika/server/resource/UnpackerResource.java (edit) tika-server/src/main/java/org/apache/tika/server/resource/RecursiveMetadataResource.java (edit) tika-server/src/main/java/org/apache/tika/server/resource/TikaResource.java (edit) tika-server/src/main/java/org/apache/tika/server/resource/MetadataResource.java (edit) tika-server/src/main/java/org/apache/tika/server/resource/DetectorResource.java (add) tika-server/src/main/java/org/apache/tika/server/URLEnabledInputStreamFactory.java (add) tika-server/src/main/java/org/apache/tika/server/DefaultInputStreamFactory.java (add) tika-server/src/main/java/org/apache/tika/server/InputStreamFactory.java (edit) tika-server/src/main/java/org/apache/tika/server/TikaServerCli.java TIKA-2081 – add fileUrl back into tika-server, update changes.txt (tallison: rev b58368f3f42f52adb76541b7a321e15bab5e04dc) (edit) CHANGES.txt
          Hide
          hudson Hudson added a comment -

          SUCCESS: Integrated in Jenkins build tika-2.x #149 (See https://builds.apache.org/job/tika-2.x/149/)

          • Re-enable fileUrl for tika-server (TIKA-2081). If you choose, (tallison: rev ce1fc3720cdcd84b5523b14fc28fd2fb355c9ee2)
          • (edit) tika-server/src/main/java/org/apache/tika/server/resource/RecursiveMetadataResource.java
          • (edit) CHANGES.txt
          • (edit) tika-server/src/main/java/org/apache/tika/server/resource/MetadataResource.java
          • (add) tika-server/src/main/java/org/apache/tika/server/URLEnabledInputStreamFactory.java
          • (add) tika-server/src/main/java/org/apache/tika/server/DefaultInputStreamFactory.java
          • (edit) tika-server/src/test/java/org/apache/tika/server/CXFTestBase.java
          • (edit) tika-server/src/main/java/org/apache/tika/server/resource/UnpackerResource.java
          • (edit) tika-server/src/main/java/org/apache/tika/server/resource/TikaResource.java
          • (edit) tika-server/src/main/java/org/apache/tika/server/TikaServerCli.java
          • (edit) tika-server/src/main/java/org/apache/tika/server/resource/DetectorResource.java
          • (add) tika-server/src/main/java/org/apache/tika/server/InputStreamFactory.java
          Show
          hudson Hudson added a comment - SUCCESS: Integrated in Jenkins build tika-2.x #149 (See https://builds.apache.org/job/tika-2.x/149/ ) Re-enable fileUrl for tika-server ( TIKA-2081 ). If you choose, (tallison: rev ce1fc3720cdcd84b5523b14fc28fd2fb355c9ee2) (edit) tika-server/src/main/java/org/apache/tika/server/resource/RecursiveMetadataResource.java (edit) CHANGES.txt (edit) tika-server/src/main/java/org/apache/tika/server/resource/MetadataResource.java (add) tika-server/src/main/java/org/apache/tika/server/URLEnabledInputStreamFactory.java (add) tika-server/src/main/java/org/apache/tika/server/DefaultInputStreamFactory.java (edit) tika-server/src/test/java/org/apache/tika/server/CXFTestBase.java (edit) tika-server/src/main/java/org/apache/tika/server/resource/UnpackerResource.java (edit) tika-server/src/main/java/org/apache/tika/server/resource/TikaResource.java (edit) tika-server/src/main/java/org/apache/tika/server/TikaServerCli.java (edit) tika-server/src/main/java/org/apache/tika/server/resource/DetectorResource.java (add) tika-server/src/main/java/org/apache/tika/server/InputStreamFactory.java
          Hide
          hudson Hudson added a comment -

          FAILURE: Integrated in Jenkins build Tika-trunk #1108 (See https://builds.apache.org/job/Tika-trunk/1108/)
          TIKA-2081 – add fileUrl back into tika-server – fix commandline (tallison: rev e9e8d3bf2b8b802ce01f23eefbe4b181ae252625)

          • (edit) tika-server/src/main/java/org/apache/tika/server/TikaServerCli.java
          Show
          hudson Hudson added a comment - FAILURE: Integrated in Jenkins build Tika-trunk #1108 (See https://builds.apache.org/job/Tika-trunk/1108/ ) TIKA-2081 – add fileUrl back into tika-server – fix commandline (tallison: rev e9e8d3bf2b8b802ce01f23eefbe4b181ae252625) (edit) tika-server/src/main/java/org/apache/tika/server/TikaServerCli.java
          Hide
          hudson Hudson added a comment -

          FAILURE: Integrated in Jenkins build tika-2.x-windows #54 (See https://builds.apache.org/job/tika-2.x-windows/54/)

          • Re-enable fileUrl for tika-server (TIKA-2081). Fix commandline (tallison: rev bd72089292357fac90c62b96c9a6d9a64adf9140)
          • (edit) tika-server/src/main/java/org/apache/tika/server/TikaServerCli.java
          Show
          hudson Hudson added a comment - FAILURE: Integrated in Jenkins build tika-2.x-windows #54 (See https://builds.apache.org/job/tika-2.x-windows/54/ ) Re-enable fileUrl for tika-server ( TIKA-2081 ). Fix commandline (tallison: rev bd72089292357fac90c62b96c9a6d9a64adf9140) (edit) tika-server/src/main/java/org/apache/tika/server/TikaServerCli.java
          Hide
          hudson Hudson added a comment -

          ABORTED: Integrated in Jenkins build tika-2.x #150 (See https://builds.apache.org/job/tika-2.x/150/)

          • Re-enable fileUrl for tika-server (TIKA-2081). Fix commandline (tallison: rev bd72089292357fac90c62b96c9a6d9a64adf9140)
          • (edit) tika-server/src/main/java/org/apache/tika/server/TikaServerCli.java
          Show
          hudson Hudson added a comment - ABORTED: Integrated in Jenkins build tika-2.x #150 (See https://builds.apache.org/job/tika-2.x/150/ ) Re-enable fileUrl for tika-server ( TIKA-2081 ). Fix commandline (tallison: rev bd72089292357fac90c62b96c9a6d9a64adf9140) (edit) tika-server/src/main/java/org/apache/tika/server/TikaServerCli.java

            People

            • Assignee:
              tallison@mitre.org Tim Allison
              Reporter:
              JDL John Dougrez-Lewis
            • Votes:
              0 Vote for this issue
              Watchers:
              3 Start watching this issue

              Dates

              • Created:
                Updated:
                Resolved:

                Development