sonatype/nexus-oss — pull request #509 by scarlucci (2014-05-07 13:58:41+00:00)
Title: REVIEW - NEXUS-6548 - Use strict (exact) URI matching

https://issues.sonatype.org/browse/NEXUS-6548
http://bamboo.zion.aws.s/browse/NX-OSSF27-3

This PR changes our URI matching from "starts with" to "exact". This addresses the security issue in NEXUS-6548, and potentially others.

Given that this change has the potential to cause problems, strict matching can be turned on/off in nexus.properties via the strict-uri-matching property. The default is strict-uri-matching=true. I have not added this property to the nexus.properties that we bundle. Looking for feedback on whether it makes sense to put it in there or not.

Due to limitations with the URI pattern syntax that restlet supports, and differences between how restlet and shiro perform URI matching, we cannot easily turn strict uri matching on for some resources. For these resources, even when strict uri matching is on, these resources explicitly turn it off.

I'm not entirely thrilled with the mechanics of turning strict on/off in PlexusRestletApplicationBridge, but given that this code is going away in 3.0, I opted for a minimal refactor that gets the job done.