## Basic information **Project name:** Eclipse BaSyx **Project id:** dt.basyx **Component:** [eclipse-basyx/basyx-go-components](https://github.com/eclipse-basyx/basyx-go-components). The ABAC middleware is shared by all services. The issue was demonstrated with the images `dppapi-go` and `aasenvironment-go`. `submodelrepository-go` and `aasrepository-go` use the same idShortPath handlers. ## What are the affected versions? Eclipse BaSyx Go Components v1.1.3 and earlier are affected, starting with v1.0.0. - The ABAC path handling described below has been unchanged since v1.0.0. This was checked by reading the code; older releases were not run. - The DPP case needs the DPP API service (`dppapi-go`), which was first released in v1.0.2. - Reproduced on current main ([2f8c410c](https://github.com/eclipse-basyx/basyx-go-components/commit/2f8c410c), 2026-11-13) with integration tests. The fix is ready in a private repository and has not been published yet. We will add the PR and the fixed release here once they are public. ## Details of the issue With ABAC enabled, a `ROUTE` rule can grant access to a different resource than the one the handler returns. The ABAC middleware matches `ROUTE` rules against the fully decoded request path (`r.URL.Path`, also passed through `path.Clean`). The router (chi) routes on the raw path (`r.URL.RawPath`). To ABAC, an encoded slash `%2F` inside a path value is a segment separator. To the router, it is part of the value. A request can therefore look like a path that a narrow rule allows, while the handler reads a different and larger resource. Two cases were confirmed: 1. **DPP API: reading a whole passport with an element-only grant.** A role whose only rule is `READ` on `ROUTE /v1/dpps/*/elements/*` may read single passport elements, but not whole passports. For a passport whose id contains `/elements/`, for example `https://example.com/b/elements/x`, the request `GET /v1/dpps/https:%2F%2Fexample.com%2Fb%2Felements%2Fx` looks like an element route to ABAC (`/v1/dpps/https:/example.com/b/elements/x`). The router sends it to the whole-passport route, which returns the complete passport with `200`. 2. **Submodel elements: reading an element through an attachment-only grant.** A role whose only rule is `READ` on `ROUTE /submodels/*/submodel-elements/*/attachment` may only download file attachments. If an element's stored idShort contains `%2F`, for example `Coll.x%2Fattachment` in data created before idShort validation was enforced, the request `GET /submodels/{id}/submodel-elements/Coll.x%2Fattachment` looks like the attachment route of `Coll.x` to ABAC. The handler reads the idShortPath without decoding it and returns the whole element `Coll.x%2Fattachment`, including its value. In both cases the caller receives data that the policy was written to withhold. The attacker needs a valid token with a narrow `ROUTE` grant. Callers without a matching rule are still denied. Weaknesses: - CWE-863: Incorrect Authorization - CWE-436: Interpretation Conflict - CWE-177: Improper Handling of URL Encoding (Hex Encoding) The fix makes ABAC see the same path structure as the router: - ABAC splits the path at the separators the router uses and decodes each segment once. - `ROUTE` rules write a slash or percent sign inside a value as `%2F` or `%25`. - Requests with `.` or `..` segments, empty segments or control characters are rejected before ABAC and routing. - idShortPath handlers decode the parameter once and accept it only if it matches the idShortPath grammar. ## Steps to reproduce Prerequisites: BaSyx Go Components v1.1.3 with ABAC (`abac.enabled: true`) and an OIDC provider (Keycloak). **Case 1: DPP API (`dppapi-go`)** 1. Add an element-only rule for a user whose `role` claim is `elementreader`: ```json { "DEFOBJECTS": [ { "name": "dpp_element_routes", "objects": [{ "ROUTE": "/v1/dpps/*/elements/*" }] } ], "DEFFORMULAS": [ { "name": "is_element_reader", "formula": { "$eq": [{ "$attribute": { "CLAIM": "role" } }, { "$strVal": "elementreader" }] } } ], "rules": [ { "USEACL": "viewer_read", "USEOBJECTS": ["dpp_element_routes"], "USEFORMULA": "is_element_reader" } ] } ``` (`viewer_read` is an ACL that grants `READ` with `ACCESS: ALLOW`.) 2. As an editor, create a passport `https://example.com/b` and a second passport with id `https://example.com/b/elements/x`. 3. As `elementreader`: | Request | Result | |---|---| | `GET /v1/dpps/https:%2F%2Fexample.com%2Fb/elements/<elementPath>` | `200` (expected) | | `GET /v1/dpps/https:%2F%2Fexample.com%2Fb` | `403` (expected) | | `GET /v1/dpps/https:%2F%2Fexample.com%2Fb%2Felements%2Fx` | **`200`, complete passport** (expected: `403`) | **Case 2: Submodel elements (`aasenvironment-go`)** 1. Create a Submodel with a SubmodelElementCollection `Coll` that has a child element with the stored idShort `x%2Fattachment`. Current versions reject this idShort on write, so the test sets it directly in the database to simulate legacy data. 2. Give a `viewer` role only `READ` on `ROUTE /submodels/*/submodel-elements/*/attachment`. 3. As `viewer`: - `GET /submodels/{base64url(id)}/submodel-elements/Coll.x%2Fattachment` → **`200`, the whole element with its value** (expected: `403`). ## Do you know any mitigations of the issue? Upgrade to the fixed release once it is available. Until then: - Do not use wildcard `ROUTE` rules that grant only part of a resource (for example `/v1/dpps/*/elements/*` or `/submodels/*/submodel-elements/*/attachment`) to callers who must not read the whole resource. Grant such callers only whole resources they may fully see. - Where no value legitimately contains a slash, reject request paths containing `%2F`/`%2f` at a reverse proxy before they reach BaSyx Go. This is not possible for the DPP API, because DPP ids contain `/`. - Check stored data for idShorts that contain `%` or `/`, and rename them to valid idShorts. Found by Christian Koort (Eclipse BaSyx Go maintainers).