[TIKA-2081] Add back 'fileUrl' functionality to TikaJAXRS Server subject to security controls

• Type: Task
• Status: Resolved
• Priority: Minor
• Resolution: Fixed
• Affects Version/s: 1.13
• Fix Version/s: 1.14, 2.0.0
• Component/s: server
• Labels: features security

Environment

All versions

• Assignee: Tim Allison
• Reporter: John Dougrez-Lewis
• Created: 17/Sep/16 07:47
• Updated: 12/Apr/21 13:02
• Resolved: 23/Sep/16 14:02

Description

Add back 'fileUrl' functionality from version 1.9 to TikaJAXRS Server subject to additional security controls:

disable by default
only enable if appropriate configuration flags are specified
when enabled print warning displaying at least CVE ID: CVE-2015-3271.

as discussed on [e-mail] mailing list under title "Query on correct use of 'fileUrl' in TikaJAXRS Server to extract document at remote url - my request is not working".

Issue Links

• is related to: TIKA-1627 Authentication for fileUrl