Wiremock: com.github.tomakehurst.wiremock.security.NotAuthorisedException - when loading stubs - relative and root path

[javapapo]

Wiremock Version 2.15.0 you could define file stubs like that

 stubFor(any(urlPathEqualTo(url))
            .withQueryParam(xxxx)
            .withQueryParam(xxxx)
            .willReturn(aResponse()
                    .withStatus(HttpStatus.OK.value())
                    .withBodyFile("/xservice/file.json")));

where /xservice/file.json was under /src/test/resources/__files/xservice/file.json

Upgrading to Version 2.17.0 and checking the implemantion of com.github.tomakehurst.wiremock.common.AbstractSourceFile I can see that the same test will fail with

com.github.tomakehurst.wiremock.security.NotAuthorisedException: Access to file /xservice/

If I strip the / from /xservice so that we define the stub like

 stubFor(any(urlPathEqualTo(url))
            .withQueryParam(xxxx)
            .withQueryParam(xxxx)
            .willReturn(aResponse()
                    .withStatus(HttpStatus.OK.value())
                    .withBodyFile("xservice/file.json")));

It works again.

I am not sure is this intentional or a bug? Mostly I am posting it in case others are affected.

Thanks!

[tomakehurst]

Hmmm....wonder if that's a side-effect of the security fixes in 2.16.0.

[ssmuch]

don't access the to check in my fix, the issue is logic of validating if assertFilePathIsUnderRoot, propose to change like:
private void assertFilePathIsUnderRoot(String path) {
try {
String rootPath = rootDirectory.getCanonicalPath();
File file = new File(rootDirectory, path);
String filePath = file.getCanonicalPath();

        // assert the file was under the RootPath, if not accessible 
        // throw the exception
        if (!file.exists()) {
            throw new NotAuthorisedException("Access to file " + path + " is not permitted. " +
                                             "filePath: " + filePath + " " + 
                                             "rootPath:" + rootPath);
        }

[WojciechZankowski]

Just wanted to mention that bug still exists in version 2.18.0

It works when I run my build on Windows, but it fails on run in Travis CI. When I strip the path from "/" at the beginning it works on both platforms.

[tomakehurst]

Closing this since there's a trivial workaround. Documented in 95a57b0721f5eea463ee3a663f1f502111f89550.

[mrk-han]

The workaround is not working for me unfortunately.

/./__files/mobile-apps.json

For some reason Wiremock is adding a /./ when looking for the bodyFileName

[tomakehurst]

@mrk-han can you describe your setup - platform, setup code and stubs?

[mrk-han]

@tomakehurst Running 2.19.0 Standalone JAR on my Macbook. Connecting to this JAR with Android Emulator pointed at 10.0.2.2. All functionality is working, but when I tried to put json responses into bodyFile I am getting this error which was unexpected.

Here is the mapping.

{
  "id" : "c6a9ef8b-2fdb-48ef-a0b2-231821d6393e",
  "name" : "stories-updated",
  "request" : {
    "url" : "/v2/mobile_screens/stories",
    "method" : "GET"
  },
  "response" : {
    "status" : 200,
    "bodyFileName" : "stories.json",
    "headers" : {
      "Content-Type" : "application/json; charset=utf-8",
      "Vary" : "Accept-Encoding",
      "Connection" : "keep-alive"
    }
  },
  "uuid" : "c6a9ef8b-2fdb-48ef-a0b2-231821d6393e"
}

[mrk-han]

It looks like there was a small typo in the naming of the files, but I was confused because the debug logging output added an extra /./ when looking for the file and I am not sure why it does this, but perhaps it could be fixed to add more information on why it could not find the file.