Improves Rest Layer Authz robustness

Signed-off-by: Darshit Chanpura <[email protected]>
DarshitChanpura · Nov 5, 2024 · 6108c30 · 6108c30
1 parent 1c898dc
commit 6108c30
Showing 1 changed file with 3 additions and 0 deletions.
diff --git a/src/main/java/org/opensearch/security/filter/SecurityRestFilter.java b/src/main/java/org/opensearch/security/filter/SecurityRestFilter.java
@@ -336,6 +336,9 @@ public void onAllowlistingSettingChanged(AllowlistingSettings allowlistingSettin
      * @return true if the request path matches the route
      */
     private boolean restPathMatches(String requestPath, String handlerPath) {
+        // Trim leading and trailing slashes
+        requestPath = requestPath.replaceAll("^/+", "").replaceAll("/+$", "");
+        handlerPath = handlerPath.replaceAll("^/+", "").replaceAll("/+$", "");
         // Check exact match
         if (handlerPath.equals(requestPath)) {
             return true;