fix: Secure x-forwarded-* headers from untrusted proxies #4171

richard-salac · 2025-06-17T13:29:38Z

Description

Enable forwarding of X-Forwarded... headers from trusted proxies only, mitigates CVE-2025-41235. The pattern to identify trusted proxies can be set via apiml.security.forwardHeader.trustedProxies property. If the request is signed by the Zowe certificate, it is trusted even of the property is not set.

If the headers are received from an untrusted source, they are removed from the request and apiml creates new ones.

cherry-pick from v2: #4148 and #4188

In addition to the cherry-pick, the gateway-service/src/main/java/org/zowe/apiml/gateway/config/ConnectionsConfig.java had to be refactored and the https factory configuration was moved into the new gateway-service/src/main/java/org/zowe/apiml/gateway/config/HttpsFactoryConfig.java class. Some tests could not be initialized because of the change in bean order initialization. The original design used @PostConstruct to initialize the https configuration into a private field which was not guaranteed to happen when mocking the class for tests. The https configuration is now injected as a bean instead. Besides that, the modification better respects the separation of concerns principle and prefers the dependency injection over setting private fields via reflection.

Linked to # (issue)
Part of the # (epic)

Type of change

Please delete options that are not relevant.

fix: Bug fix (non-breaking change which fixes an issue)
feat: New feature (non-breaking change which adds functionality)
docs: Change in a documentation
refactor: Refactor the code
chore: Chore, repository cleanup, updates the dependencies.
BREAKING CHANGE or !: Breaking change (fix or feature that would cause existing functionality to not work as expected)

Checklist:

My code follows the style guidelines of this project
PR title conforms to commit message guideline ## Commit Message Structure Guideline
I have commented my code, particularly in hard-to-understand areas. In JS I did provide JSDoc
I have made corresponding changes to the documentation
My changes generate no new warnings
I have added tests that prove my fix is effective or that my feature works
New and existing unit tests pass locally with my changes
The java tests in the area I was working on leverage @nested annotations
Any dependent changes have been merged and published in downstream modules

For more details about how should the code look like read the Contributing guideline

Signed-off-by: Richard Salac <[email protected]>

gateway-package/src/main/resources/bin/start.sh

gateway-service/src/main/java/org/zowe/apiml/gateway/config/ConnectionsConfig.java

.../java/org/zowe/apiml/gateway/filters/proxyheaders/AdditionalRegistrationGatewayRegistry.java

.../java/org/zowe/apiml/gateway/filters/proxyheaders/X509AndGwAwareXForwardedHeadersFilter.java

...c/test/java/org/zowe/apiml/gateway/acceptance/xForwardHeaders/MutateRemoteAddressFilter.java

integration-tests/src/test/java/org/zowe/apiml/integration/proxy/XForwardHeadersProxyTest.java

integration-tests/src/test/java/org/zowe/apiml/util/config/ConfigReader.java

…roxyheaders/AdditionalRegistrationGatewayRegistry.java Co-authored-by: Elena Kubantseva <[email protected]> Signed-off-by: Richard Salač <[email protected]>

…xy/XForwardHeadersProxyTest.java Co-authored-by: Elena Kubantseva <[email protected]> Signed-off-by: Richard Salač <[email protected]>

…e/xForwardHeaders/MutateRemoteAddressFilter.java Co-authored-by: Elena Kubantseva <[email protected]> Signed-off-by: Richard Salač <[email protected]>

…xy/XForwardHeadersProxyTest.java Co-authored-by: Elena Kubantseva <[email protected]> Signed-off-by: Richard Salač <[email protected]>

Co-authored-by: Elena Kubantseva <[email protected]> Signed-off-by: Richard Salač <[email protected]>

…roxyheaders/AdditionalRegistrationGatewayRegistryTest.java Co-authored-by: Elena Kubantseva <[email protected]> Signed-off-by: Richard Salač <[email protected]>

…xy/XForwardHeadersProxyTest.java Co-authored-by: Elena Kubantseva <[email protected]> Signed-off-by: Richard Salač <[email protected]>

Signed-off-by: Richard Salac <[email protected]> Signed-off-by: Richard Salač <[email protected]>

Signed-off-by: Richard Salac <[email protected]>

Signed-off-by: Richard Salac <[email protected]> refactor it Signed-off-by: Richard Salac <[email protected]>

gateway-service/src/main/java/org/zowe/apiml/gateway/config/HttpsFactoryConfig.java

arxioly

Other then order of the services in integration-tests.yml 🤓 LGTM

Signed-off-by: Richard Salac <[email protected]>

sonarqubecloud · 2025-07-18T15:30:51Z

Quality Gate passed

Issues
21 New issues
0 Accepted issues

Measures
0 Security Hotspots
80.9% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

github-project-automation bot moved this to New in API Mediation Layer Backlog Management Jun 17, 2025

github-project-automation bot added this to API Mediation Layer Backlog Management Jun 17, 2025

pull-request-size bot added the size/XL label Jun 17, 2025

github-actions bot added the Sensitive Sensitive change that requires peer review label Jun 17, 2025

richard-salac changed the base branch from v3.x.x to reboot/update/v3_java_only June 17, 2025 13:30

richard-salac changed the title ~~Secure x-forwarded-* headers from untrusted proxies~~ fix: Secure x-forwarded-* headers from untrusted proxies Jun 17, 2025

richard-salac changed the title ~~fix: Secure x-forwarded-* headers from untrusted proxies~~ DRAFT: fix: Secure x-forwarded-* headers from untrusted proxies Jun 17, 2025

richard-salac changed the base branch from reboot/update/v3_java_only to v3.x.x June 17, 2025 14:34

EvaJavornicka moved this from New to In Progress in API Mediation Layer Backlog Management Jun 18, 2025

richard-salac force-pushed the reboot/trusted-proxies-v3 branch from 5978bd6 to 847c15f Compare July 8, 2025 13:57

pull-request-size bot added size/XXL and removed size/XL labels Jul 8, 2025

richard-salac force-pushed the reboot/trusted-proxies-v3 branch 6 times, most recently from e6377d7 to d118c96 Compare July 14, 2025 12:31

do not forward x-forwarded headers for untrusted proxies

9fcb475

Signed-off-by: Richard Salac <[email protected]>

richard-salac force-pushed the reboot/trusted-proxies-v3 branch from d118c96 to 9fcb475 Compare July 14, 2025 14:41

richard-salac changed the title ~~DRAFT: fix: Secure x-forwarded-* headers from untrusted proxies~~ fix: Secure x-forwarded-* headers from untrusted proxies Jul 15, 2025

Merge branch 'v3.x.x' into reboot/trusted-proxies-v3

8fa235e

arxioly reviewed Jul 15, 2025

View reviewed changes

richard-salac and others added 7 commits July 15, 2025 19:11

Update gateway-service/src/main/java/org/zowe/apiml/gateway/filters/p…

386068e

…roxyheaders/AdditionalRegistrationGatewayRegistry.java Co-authored-by: Elena Kubantseva <[email protected]> Signed-off-by: Richard Salač <[email protected]>

Update integration-tests/src/test/java/org/zowe/apiml/integration/pro…

d4c7098

…xy/XForwardHeadersProxyTest.java Co-authored-by: Elena Kubantseva <[email protected]> Signed-off-by: Richard Salač <[email protected]>

Update gateway-service/src/test/java/org/zowe/apiml/gateway/acceptanc…

09e5429

…e/xForwardHeaders/MutateRemoteAddressFilter.java Co-authored-by: Elena Kubantseva <[email protected]> Signed-off-by: Richard Salač <[email protected]>

Update integration-tests/src/test/java/org/zowe/apiml/integration/pro…

b4d3f6c

…xy/XForwardHeadersProxyTest.java Co-authored-by: Elena Kubantseva <[email protected]> Signed-off-by: Richard Salač <[email protected]>

Update gateway-package/src/main/resources/bin/start.sh

60af29d

Co-authored-by: Elena Kubantseva <[email protected]> Signed-off-by: Richard Salač <[email protected]>

Update gateway-service/src/test/java/org/zowe/apiml/gateway/filters/p…

e08ec72

…roxyheaders/AdditionalRegistrationGatewayRegistryTest.java Co-authored-by: Elena Kubantseva <[email protected]> Signed-off-by: Richard Salač <[email protected]>

Update gateway-service/src/test/java/org/zowe/apiml/gateway/filters/p…

ad72161

…roxyheaders/AdditionalRegistrationGatewayRegistryTest.java Co-authored-by: Elena Kubantseva <[email protected]> Signed-off-by: Richard Salač <[email protected]>

richard-salac and others added 8 commits July 15, 2025 19:21

Update gateway-service/src/test/java/org/zowe/apiml/gateway/filters/p…

c55a85d

…roxyheaders/AdditionalRegistrationGatewayRegistryTest.java Co-authored-by: Elena Kubantseva <[email protected]> Signed-off-by: Richard Salač <[email protected]>

Update integration-tests/src/test/java/org/zowe/apiml/integration/pro…

04060b6

…xy/XForwardHeadersProxyTest.java Co-authored-by: Elena Kubantseva <[email protected]> Signed-off-by: Richard Salač <[email protected]>

cr

1e4eecf

Signed-off-by: Richard Salac <[email protected]> Signed-off-by: Richard Salač <[email protected]>

Merge branch 'v3.x.x' into reboot/trusted-proxies-v3

28f3cdb

cr

e830509

Signed-off-by: Richard Salac <[email protected]>

fix it config

5154e3d

Signed-off-by: Richard Salac <[email protected]>

Merge branch 'v3.x.x' into reboot/trusted-proxies-v3

ae45617

resolve bean initialization conflict with modulith

6a9469b

Signed-off-by: Richard Salac <[email protected]>

richard-salac force-pushed the reboot/trusted-proxies-v3 branch 2 times, most recently from dee4354 to 6a9469b Compare July 18, 2025 12:47

fix it config

385ce08

Signed-off-by: Richard Salac <[email protected]> refactor it Signed-off-by: Richard Salac <[email protected]>

richard-salac force-pushed the reboot/trusted-proxies-v3 branch from a8a47c5 to 385ce08 Compare July 18, 2025 13:17

Merge branch 'v3.x.x' into reboot/trusted-proxies-v3

3f4a573

richard-salac commented Jul 18, 2025

View reviewed changes

gateway-service/src/main/java/org/zowe/apiml/gateway/config/HttpsFactoryConfig.java Outdated Show resolved Hide resolved

arxioly approved these changes Jul 18, 2025

View reviewed changes

reformat it setup

8575d84

Signed-off-by: Richard Salac <[email protected]>

richard-salac force-pushed the reboot/trusted-proxies-v3 branch from 0e5fc37 to 8575d84 Compare July 18, 2025 15:15

richard-salac merged commit ff8c81d into v3.x.x Jul 18, 2025
103 of 105 checks passed

richard-salac deleted the reboot/trusted-proxies-v3 branch July 18, 2025 15:51

github-project-automation bot moved this from In Progress to Done in API Mediation Layer Backlog Management Jul 18, 2025

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

fix: Secure x-forwarded-* headers from untrusted proxies #4171

fix: Secure x-forwarded-* headers from untrusted proxies #4171

Uh oh!

richard-salac commented Jun 17, 2025 •

edited

Loading

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

arxioly left a comment

Uh oh!

sonarqubecloud bot commented Jul 18, 2025

Uh oh!

Uh oh!

Uh oh!

fix: Secure x-forwarded-* headers from untrusted proxies #4171

fix: Secure x-forwarded-* headers from untrusted proxies #4171

Uh oh!

Conversation

richard-salac commented Jun 17, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Description

Type of change

Checklist:

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

arxioly left a comment

Choose a reason for hiding this comment

Uh oh!

sonarqubecloud bot commented Jul 18, 2025

Quality Gate passed

Uh oh!

Uh oh!

Uh oh!

richard-salac commented Jun 17, 2025 •

edited

Loading