You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Upon a recent penetration testing of WSO2 APIM 4.1.0 (Update Level 73), we identified an issue related to error code handling when sending malformed requests to non-existent API endpoints.
As an example, when sending a request to an unavailable API endpoint (e.g., https://localhost:8243/jbossmq-httpil/HTTPServerILServlet) with a binary file (.yaml extension), the WSO2 product returns a 500 error instead of the expected 4xx error. The error code observed is ERROR_CODE=601000.
We also fixed this issue by changing the main.xml in APIM. The main.xml files which we changed can be found in the following two locations.
2023-06-21 14:48:49,473] ERROR - AnonymousListMediator Error while building message. Error while building Passthrough stream
org.apache.axis2.AxisFault: Error while building Passthrough stream
at org.apache.synapse.transport.passthru.util.RelayUtils.handleException(RelayUtils.java:453) ~[synapse-nhttp-transport_2.1.7.wso2v271_17.jar:?]
at org.apache.synapse.transport.passthru.util.RelayUtils.buildMessage(RelayUtils.java:216) ~[synapse-nhttp-transport_2.1.7.wso2v271_17.jar:?]
at org.apache.synapse.transport.passthru.util.RelayUtils.buildMessage(RelayUtils.java:122) ~[synapse-nhttp-transport_2.1.7.wso2v271_17.jar:?]
at org.apache.synapse.transport.util.PassThroughMessageHandler.buildMessage(PassThroughMessageHandler.java:103) ~[synapse-nhttp-transport_2.1.7.wso2v271_17.jar:?]
at org.apache.synapse.mediators.AbstractListMediator.buildMessage(AbstractListMediator.java:155) ~[synapse-core_2.1.7.wso2v271_18.jar:2.1.7-wso2v271.18]
at org.apache.synapse.mediators.AbstractListMediator.mediate(AbstractListMediator.java:96) ~[synapse-core_2.1.7.wso2v271_18.jar:2.1.7-wso2v271.18]
at org.apache.synapse.mediators.AbstractListMediator.mediate(AbstractListMediator.java:72) ~[synapse-core_2.1.7.wso2v271_18.jar:2.1.7-wso2v271.18]
at org.apache.synapse.config.xml.AnonymousListMediator.mediate(AnonymousListMediator.java:37) ~[synapse-core_2.1.7.wso2v271_18.jar:2.1.7-wso2v271.18]
at org.apache.synapse.mediators.filters.FilterMediator.mediate(FilterMediator.java:205) ~[synapse-core_2.1.7.wso2v271_18.jar:2.1.7-wso2v271.18]
at org.apache.synapse.mediators.AbstractListMediator.mediate(AbstractListMediator.java:110) ~[synapse-core_2.1.7.wso2v271_18.jar:2.1.7-wso2v271.18]
at org.apache.synapse.mediators.AbstractListMediator.mediate(AbstractListMediator.java:72) ~[synapse-core_2.1.7.wso2v271_18.jar:2.1.7-wso2v271.18]
at org.apache.synapse.mediators.filters.InMediator.mediate(InMediator.java:74) ~[synapse-core_2.1.7.wso2v271_18.jar:2.1.7-wso2v271.18]
at org.apache.synapse.mediators.AbstractListMediator.mediate(AbstractListMediator.java:110) ~[synapse-core_2.1.7.wso2v271_18.jar:2.1.7-wso2v271.18]
at org.apache.synapse.mediators.AbstractListMediator.mediate(AbstractListMediator.java:72) ~[synapse-core_2.1.7.wso2v271_18.jar:2.1.7-wso2v271.18]
at org.apache.synapse.mediators.base.SequenceMediator.mediate(SequenceMediator.java:158) ~[synapse-core_2.1.7.wso2v271_18.jar:2.1.7-wso2v271.18]
at org.apache.synapse.core.axis2.Axis2SynapseEnvironment.injectMessage(Axis2SynapseEnvironment.java:354) ~[synapse-core_2.1.7.wso2v271_18.jar:2.1.7-wso2v271.18]
at org.apache.synapse.core.axis2.SynapseMessageReceiver.receive(SynapseMessageReceiver.java:101) ~[synapse-core_2.1.7.wso2v271_18.jar:2.1.7-wso2v271.18]
at org.apache.axis2.engine.AxisEngine.receive(AxisEngine.java:180) ~[axis2_1.6.1.wso2v80.jar:?]
at org.apache.synapse.transport.passthru.ServerWorker.processNonEntityEnclosingRESTHandler(ServerWorker.java:376) ~[synapse-nhttp-transport_2.1.7.wso2v271_17.jar:?]
at org.apache.synapse.transport.passthru.ServerWorker.processEntityEnclosingRequest(ServerWorker.java:435) ~[synapse-nhttp-transport_2.1.7.wso2v271_17.jar:?]
at org.apache.synapse.transport.passthru.ServerWorker.run(ServerWorker.java:183) ~[synapse-nhttp-transport_2.1.7.wso2v271_17.jar:?]
at org.apache.axis2.transport.base.threads.NativeWorkerPool$1.run(NativeWorkerPool.java:172) ~[axis2_1.6.1.wso2v80.jar:?]
at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1128) ~[?:?]
at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:628) ~[?:?]
at java.lang.Thread.run(Thread.java:829) [?:?]
Caused by: org.apache.commons.fileupload.InvalidFileNameException: Invalid file name: %{(#nike='multipart/form-data').(#[email protected]@DEFAULT_MEMBER_ACCESS).(#_memberAccess?(#_memberAccess=#dm):((#container=#context['com.opensymphony.xwork2.ActionContext.container']).(#ognlUtil=#container.getInstance(@com.opensymphony.xwork2.ognl.OgnlUtil@class)).(#ognlUtil.getExcludedPackageNames().clear()).(#ognlUtil.getExcludedClasses().clear()).(#context.setMemberAccess(#dm)))).(#cmdwin='ipconfig').(#cmdlinux='ifconfig').(#iswin=(@java.lang.System@getProperty('os.name').toLowerCase().contains('win'))).(#cmds=(#iswin?{'cmd.exe','/c',#cmdwin}:{'/bin/bash','-c',#cmdlinux})).(#p=new java.lang.ProcessBuilder(#cmds)).(#p.redirectErrorStream(true)).(#process=#p.start()).(#ros=(@org.apache.struts2.ServletActionContext@getResponse().getOutputStream())).(@org.apache.commons.io.IOUtils@copy(#process.getInputStream(),#ros)).(#ros.flush())}\0b
at org.apache.commons.fileupload.util.Streams.checkFileName(Streams.java:187) ~[commons-fileupload_1.5.0.wso2v1.jar:?]
at org.apache.commons.fileupload.disk.DiskFileItem.getName(DiskFileItem.java:253) ~[commons-fileupload_1.5.0.wso2v1.jar:?]
at org.apache.axis2.builder.DiskFileDataSource.getName(DiskFileDataSource.java:46) ~[axis2_1.6.1.wso2v80.jar:?]
at org.apache.axis2.builder.BuilderUtil.addRequestParameter(BuilderUtil.java:229) ~[axis2_1.6.1.wso2v80.jar:?]
at org.apache.axis2.builder.BuilderUtil.createSOAPMessageWithoutSchema(BuilderUtil.java:211) ~[axis2_1.6.1.wso2v80.jar:?]
at org.apache.axis2.builder.BuilderUtil.buildsoapMessage(BuilderUtil.java:117) ~[axis2_1.6.1.wso2v80.jar:?]
at org.apache.axis2.builder.MultipartFormDataBuilder.processDocument(MultipartFormDataBuilder.java:93) ~[axis2_1.6.1.wso2v80.jar:?]
at org.apache.synapse.transport.passthru.util.DeferredMessageBuilder.getDocument(DeferredMessageBuilder.java:153) ~[synapse-nhttp-transport_2.1.7.wso2v271_17.jar:?]
at org.apache.synapse.transport.passthru.util.RelayUtils.buildMessage(RelayUtils.java:169) ~[synapse-nhttp-transport_2.1.7.wso2v271_17.jar:?]
... 23 more
[2023-06-21 14:48:49,609] INFO - LogMediator STATUS = Executing default 'fault' sequence, ERROR_CODE = 0, ERROR_MESSAGE = Error while building message. Error while building Passthrough stream
[2023-06-21 14:48:49,668] INFO - LogMediator STATUS = Message dispatched to the main sequence. Invalid URL., RESOURCE = /index.do, HEALTH CHECK URL = /index.do
[2023-06-21 14:48:49,669] ERROR - RelayUtils Error while building Passthrough stream
org.apache.commons.fileupload.InvalidFileNameException: Invalid file name: %{(#nike='multipart/form-data').(#[email protected]@DEFAULT_MEMBER_ACCESS).(#_memberAccess?(#_memberAccess=#dm):((#container=#context['com.opensymphony.xwork2.ActionContext.container']).(#ognlUtil=#container.getInstance(@com.opensymphony.xwork2.ognl.OgnlUtil@class)).(#ognlUtil.getExcludedPackageNames().clear()).(#ognlUtil.getExcludedClasses().clear()).(#context.setMemberAccess(#dm)))).(#cmdwin='ipconfig').(#cmdlinux='ifconfig').(#iswin=(@java.lang.System@getProperty('os.name').toLowerCase().contains('win'))).(#cmds=(#iswin?{'cmd.exe','/c',#cmdwin}:{'/bin/bash','-c',#cmdlinux})).(#p=new java.lang.ProcessBuilder(#cmds)).(#p.redirectErrorStream(true)).(#process=#p.start()).(#ros=(@org.apache.struts2.ServletActionContext@getResponse().getOutputStream())).(@org.apache.commons.io.IOUtils@copy(#process.getInputStream(),#ros)).(#ros.flush())}\0b
at org.apache.commons.fileupload.util.Streams.checkFileName(Streams.java:187) ~[commons-fileupload_1.5.0.wso2v1.jar:?]
at org.apache.commons.fileupload.disk.DiskFileItem.getName(DiskFileItem.java:253) ~[commons-fileupload_1.5.0.wso2v1.jar:?]
at org.apache.axis2.builder.DiskFileDataSource.getName(DiskFileDataSource.java:46) ~[axis2_1.6.1.wso2v80.jar:?]
at org.apache.axis2.builder.BuilderUtil.addRequestParameter(BuilderUtil.java:229) ~[axis2_1.6.1.wso2v80.jar:?]
at org.apache.axis2.builder.BuilderUtil.createSOAPMessageWithoutSchema(BuilderUtil.java:211) ~[axis2_1.6.1.wso2v80.jar:?]
at org.apache.axis2.builder.BuilderUtil.buildsoapMessage(BuilderUtil.java:117) ~[axis2_1.6.1.wso2v80.jar:?]
at org.apache.axis2.builder.MultipartFormDataBuilder.processDocument(MultipartFormDataBuilder.java:93) ~[axis2_1.6.1.wso2v80.jar:?]
at org.apache.synapse.transport.passthru.util.DeferredMessageBuilder.getDocument(DeferredMessageBuilder.java:153) ~[synapse-nhttp-transport_2.1.7.wso2v271_17.jar:?]
at org.apache.synapse.transport.passthru.util.RelayUtils.buildMessage(RelayUtils.java:169) ~[synapse-nhttp-transport_2.1.7.wso2v271_17.jar:?]
at org.apache.synapse.transport.passthru.util.RelayUtils.buildMessage(RelayUtils.java:122) ~[synapse-nhttp-transport_2.1.7.wso2v271_17.jar:?]
at org.apache.synapse.transport.util.PassThroughMessageHandler.buildMessage(PassThroughMessageHandler.java:103) ~[synapse-nhttp-transport_2.1.7.wso2v271_17.jar:?]
at org.apache.synapse.mediators.AbstractListMediator.buildMessage(AbstractListMediator.java:155) ~[synapse-core_2.1.7.wso2v271_18.jar:2.1.7-wso2v271.18]
at org.apache.synapse.mediators.AbstractListMediator.mediate(AbstractListMediator.java:96) ~[synapse-core_2.1.7.wso2v271_18.jar:2.1.7-wso2v271.18]
at org.apache.synapse.mediators.AbstractListMediator.mediate(AbstractListMediator.java:72) ~[synapse-core_2.1.7.wso2v271_18.jar:2.1.7-wso2v271.18]
at org.apache.synapse.config.xml.AnonymousListMediator.mediate(AnonymousListMediator.java:37) ~[synapse-core_2.1.7.wso2v271_18.jar:2.1.7-wso2v271.18]
at org.apache.synapse.mediators.filters.FilterMediator.mediate(FilterMediator.java:205) ~[synapse-core_2.1.7.wso2v271_18.jar:2.1.7-wso2v271.18]
at org.apache.synapse.mediators.AbstractListMediator.mediate(AbstractListMediator.java:110) ~[synapse-core_2.1.7.wso2v271_18.jar:2.1.7-wso2v271.18]
at org.apache.synapse.mediators.AbstractListMediator.mediate(AbstractListMediator.java:72) ~[synapse-core_2.1.7.wso2v271_18.jar:2.1.7-wso2v271.18]
at org.apache.synapse.mediators.filters.InMediator.mediate(InMediator.java:74) ~[synapse-core_2.1.7.wso2v271_18.jar:2.1.7-wso2v271.18]
at org.apache.synapse.mediators.AbstractListMediator.mediate(AbstractListMediator.java:110) ~[synapse-core_2.1.7.wso2v271_18.jar:2.1.7-wso2v271.18]
at org.apache.synapse.mediators.AbstractListMediator.mediate(AbstractListMediator.java:72) ~[synapse-core_2.1.7.wso2v271_18.jar:2.1.7-wso2v271.18]
at org.apache.synapse.mediators.base.SequenceMediator.mediate(SequenceMediator.java:158) ~[synapse-core_2.1.7.wso2v271_18.jar:2.1.7-wso2v271.18]
at org.apache.synapse.core.axis2.Axis2SynapseEnvironment.injectMessage(Axis2SynapseEnvironment.java:354) ~[synapse-core_2.1.7.wso2v271_18.jar:2.1.7-wso2v271.18]
at org.apache.synapse.core.axis2.SynapseMessageReceiver.receive(SynapseMessageReceiver.java:101) ~[synapse-core_2.1.7.wso2v271_18.jar:2.1.7-wso2v271.18]
at org.apache.axis2.engine.AxisEngine.receive(AxisEngine.java:180) ~[axis2_1.6.1.wso2v80.jar:?]
at org.apache.synapse.transport.passthru.ServerWorker.processNonEntityEnclosingRESTHandler(ServerWorker.java:376) ~[synapse-nhttp-transport_2.1.7.wso2v271_17.jar:?]
at org.apache.synapse.transport.passthru.ServerWorker.processEntityEnclosingRequest(ServerWorker.java:435) ~[synapse-nhttp-transport_2.1.7.wso2v271_17.jar:?]
at org.apache.synapse.transport.passthru.ServerWorker.run(ServerWorker.java:183) ~[synapse-nhttp-transport_2.1.7.wso2v271_17.jar:?]
at org.apache.axis2.transport.base.threads.NativeWorkerPool$1.run(NativeWorkerPool.java:172) ~[axis2_1.6.1.wso2v80.jar:?]
at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1128) ~[?:?]
at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:628) ~[?:?]
at java.lang.Thread.run(Thread.java:829) [?:?]
[2023-06-21 14:48:49,669] ERROR - AnonymousListMediator Error while building message. Error while building Passthrough stream
org.apache.axis2.AxisFault: Error while building Passthrough stream
at org.apache.synapse.transport.passthru.util.RelayUtils.handleException(RelayUtils.java:453) ~[synapse-nhttp-transport_2.1.7.wso2v271_17.jar:?]
at org.apache.synapse.transport.passthru.util.RelayUtils.buildMessage(RelayUtils.java:216) ~[synapse-nhttp-transport_2.1.7.wso2v271_17.jar:?]
at org.apache.synapse.transport.passthru.util.RelayUtils.buildMessage(RelayUtils.java:122) ~[synapse-nhttp-transport_2.1.7.wso2v271_17.jar:?]
at org.apache.synapse.transport.util.PassThroughMessageHandler.buildMessage(PassThroughMessageHandler.java:103) ~[synapse-nhttp-transport_2.1.7.wso2v271_17.jar:?]
at org.apache.synapse.mediators.AbstractListMediator.buildMessage(AbstractListMediator.java:155) ~[synapse-core_2.1.7.wso2v271_18.jar:2.1.7-wso2v271.18]
at org.apache.synapse.mediators.AbstractListMediator.mediate(AbstractListMediator.java:96) ~[synapse-core_2.1.7.wso2v271_18.jar:2.1.7-wso2v271.18]
at org.apache.synapse.mediators.AbstractListMediator.mediate(AbstractListMediator.java:72) ~[synapse-core_2.1.7.wso2v271_18.jar:2.1.7-wso2v271.18]
at org.apache.synapse.config.xml.AnonymousListMediator.mediate(AnonymousListMediator.java:37) ~[synapse-core_2.1.7.wso2v271_18.jar:2.1.7-wso2v271.18]
at org.apache.synapse.mediators.filters.FilterMediator.mediate(FilterMediator.java:205) ~[synapse-core_2.1.7.wso2v271_18.jar:2.1.7-wso2v271.18]
at org.apache.synapse.mediators.AbstractListMediator.mediate(AbstractListMediator.java:110) ~[synapse-core_2.1.7.wso2v271_18.jar:2.1.7-wso2v271.18]
at org.apache.synapse.mediators.AbstractListMediator.mediate(AbstractListMediator.java:72) ~[synapse-core_2.1.7.wso2v271_18.jar:2.1.7-wso2v271.18]
at org.apache.synapse.mediators.filters.InMediator.mediate(InMediator.java:74) ~[synapse-core_2.1.7.wso2v271_18.jar:2.1.7-wso2v271.18]
at org.apache.synapse.mediators.AbstractListMediator.mediate(AbstractListMediator.java:110) ~[synapse-core_2.1.7.wso2v271_18.jar:2.1.7-wso2v271.18]
at org.apache.synapse.mediators.AbstractListMediator.mediate(AbstractListMediator.java:72) ~[synapse-core_2.1.7.wso2v271_18.jar:2.1.7-wso2v271.18]
at org.apache.synapse.mediators.base.SequenceMediator.mediate(SequenceMediator.java:158) ~[synapse-core_2.1.7.wso2v271_18.jar:2.1.7-wso2v271.18]
at org.apache.synapse.core.axis2.Axis2SynapseEnvironment.injectMessage(Axis2SynapseEnvironment.java:354) ~[synapse-core_2.1.7.wso2v271_18.jar:2.1.7-wso2v271.18]
at org.apache.synapse.core.axis2.SynapseMessageReceiver.receive(SynapseMessageReceiver.java:101) ~[synapse-core_2.1.7.wso2v271_18.jar:2.1.7-wso2v271.18]
at org.apache.axis2.engine.AxisEngine.receive(AxisEngine.java:180) ~[axis2_1.6.1.wso2v80.jar:?]
at org.apache.synapse.transport.passthru.ServerWorker.processNonEntityEnclosingRESTHandler(ServerWorker.java:376) ~[synapse-nhttp-transport_2.1.7.wso2v271_17.jar:?]
at org.apache.synapse.transport.passthru.ServerWorker.processEntityEnclosingRequest(ServerWorker.java:435) ~[synapse-nhttp-transport_2.1.7.wso2v271_17.jar:?]
at org.apache.synapse.transport.passthru.ServerWorker.run(ServerWorker.java:183) ~[synapse-nhttp-transport_2.1.7.wso2v271_17.jar:?]
at org.apache.axis2.transport.base.threads.NativeWorkerPool$1.run(NativeWorkerPool.java:172) ~[axis2_1.6.1.wso2v80.jar:?]
at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1128) ~[?:?]
at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:628) ~[?:?]
at java.lang.Thread.run(Thread.java:829) [?:?]
Caused by: org.apache.commons.fileupload.InvalidFileNameException: Invalid file name: %{(#nike='multipart/form-data').(#[email protected]@DEFAULT_MEMBER_ACCESS).(#_memberAccess?(#_memberAccess=#dm):((#container=#context['com.opensymphony.xwork2.ActionContext.container']).(#ognlUtil=#container.getInstance(@com.opensymphony.xwork2.ognl.OgnlUtil@class)).(#ognlUtil.getExcludedPackageNames().clear()).(#ognlUtil.getExcludedClasses().clear()).(#context.setMemberAccess(#dm)))).(#cmdwin='ipconfig').(#cmdlinux='ifconfig').(#iswin=(@java.lang.System@getProperty('os.name').toLowerCase().contains('win'))).(#cmds=(#iswin?{'cmd.exe','/c',#cmdwin}:{'/bin/bash','-c',#cmdlinux})).(#p=new java.lang.ProcessBuilder(#cmds)).(#p.redirectErrorStream(true)).(#process=#p.start()).(#ros=(@org.apache.struts2.ServletActionContext@getResponse().getOutputStream())).(@org.apache.commons.io.IOUtils@copy(#process.getInputStream(),#ros)).(#ros.flush())}\0b
at org.apache.commons.fileupload.util.Streams.checkFileName(Streams.java:187) ~[commons-fileupload_1.5.0.wso2v1.jar:?]
at org.apache.commons.fileupload.disk.DiskFileItem.getName(DiskFileItem.java:253) ~[commons-fileupload_1.5.0.wso2v1.jar:?]
at org.apache.axis2.builder.DiskFileDataSource.getName(DiskFileDataSource.java:46) ~[axis2_1.6.1.wso2v80.jar:?]
at org.apache.axis2.builder.BuilderUtil.addRequestParameter(BuilderUtil.java:229) ~[axis2_1.6.1.wso2v80.jar:?]
at org.apache.axis2.builder.BuilderUtil.createSOAPMessageWithoutSchema(BuilderUtil.java:211) ~[axis2_1.6.1.wso2v80.jar:?]
at org.apache.axis2.builder.BuilderUtil.buildsoapMessage(BuilderUtil.java:117) ~[axis2_1.6.1.wso2v80.jar:?]
at org.apache.axis2.builder.MultipartFormDataBuilder.processDocument(MultipartFormDataBuilder.java:93) ~[axis2_1.6.1.wso2v80.jar:?]
at org.apache.synapse.transport.passthru.util.DeferredMessageBuilder.getDocument(DeferredMessageBuilder.java:153) ~[synapse-nhttp-transport_2.1.7.wso2v271_17.jar:?]
at org.apache.synapse.transport.passthru.util.RelayUtils.buildMessage(RelayUtils.java:169) ~[synapse-nhttp-transport_2.1.7.wso2v271_17.jar:?]
... 23 more
[2023-06-21 14:48:49,801] INFO - LogMediator STATUS = Executing default 'fault' sequence, ERROR_CODE = 0, ERROR_MESSAGE = Error while building message. Error while building Passthrough stream
[2023-06-21 14:48:49,860] INFO - LogMediator STATUS = Message dispatched to the main sequence. Invalid URL., RESOURCE = /index.action, HEALTH CHECK URL = /index.action
[2023-06-21 14:48:49,861] ERROR - RelayUtils Error while building Passthrough stream
org.apache.commons.fileupload.InvalidFileNameException: Invalid file name: %{(#nike='multipart/form-data').(#[email protected]@DEFAULT_MEMBER_ACCESS).(#_memberAccess?(#_memberAccess=#dm):((#container=#context['com.opensymphony.xwork2.ActionContext.container']).(#ognlUtil=#container.getInstance(@com.opensymphony.xwork2.ognl.OgnlUtil@class)).(#ognlUtil.getExcludedPackageNames().clear()).(#ognlUtil.getExcludedClasses().clear()).(#context.setMemberAccess(#dm)))).(#cmdwin='ipconfig').(#cmdlinux='ifconfig').(#iswin=(@java.lang.System@getProperty('os.name').toLowerCase().contains('win'))).(#cmds=(#iswin?{'cmd.exe','/c',#cmdwin}:{'/bin/bash','-c',#cmdlinux})).(#p=new java.lang.ProcessBuilder(#cmds)).(#p.redirectErrorStream(true)).(#process=#p.start()).(#ros=(@org.apache.struts2.ServletActionContext@getResponse().getOutputStream())).(@org.apache.commons.io.IOUtils@copy(#process.getInputStream(),#ros)).(#ros.flush())}\0b
at org.apache.commons.fileupload.util.Streams.checkFileName(Streams.java:187) ~[commons-fileupload_1.5.0.wso2v1.jar:?]
at org.apache.commons.fileupload.disk.DiskFileItem.getName(DiskFileItem.java:253) ~[commons-fileupload_1.5.0.wso2v1.jar:?]
at org.apache.axis2.builder.DiskFileDataSource.getName(DiskFileDataSource.java:46) ~[axis2_1.6.1.wso2v80.jar:?]
at org.apache.axis2.builder.BuilderUtil.addRequestParameter(BuilderUtil.java:229) ~[axis2_1.6.1.wso2v80.jar:?]
at org.apache.axis2.builder.BuilderUtil.createSOAPMessageWithoutSchema(BuilderUtil.java:211) ~[axis2_1.6.1.wso2v80.jar:?]
at org.apache.axis2.builder.BuilderUtil.buildsoapMessage(BuilderUtil.java:117) ~[axis2_1.6.1.wso2v80.jar:?]
at org.apache.axis2.builder.MultipartFormDataBuilder.processDocument(MultipartFormDataBuilder.java:93) ~[axis2_1.6.1.wso2v80.jar:?]
at org.apache.synapse.transport.passthru.util.DeferredMessageBuilder.getDocument(DeferredMessageBuilder.java:153) ~[synapse-nhttp-transport_2.1.7.wso2v271_17.jar:?]
at org.apache.synapse.transport.passthru.util.RelayUtils.buildMessage(RelayUtils.java:169) ~[synapse-nhttp-transport_2.1.7.wso2v271_17.jar:?]
at org.apache.synapse.transport.passthru.util.RelayUtils.buildMessage(RelayUtils.java:122) ~[synapse-nhttp-transport_2.1.7.wso2v271_17.jar:?]
at org.apache.synapse.transport.util.PassThroughMessageHandler.buildMessage(PassThroughMessageHandler.java:103) ~[synapse-nhttp-transport_2.1.7.wso2v271_17.jar:?]
at org.apache.synapse.mediators.AbstractListMediator.buildMessage(AbstractListMediator.java:155) ~[synapse-core_2.1.7.wso2v271_18.jar:2.1.7-wso2v271.18]
at org.apache.synapse.mediators.AbstractListMediator.mediate(AbstractListMediator.java:96) ~[synapse-core_2.1.7.wso2v271_18.jar:2.1.7-wso2v271.18]
at org.apache.synapse.mediators.AbstractListMediator.mediate(AbstractListMediator.java:72) ~[synapse-core_2.1.7.wso2v271_18.jar:2.1.7-wso2v271.18]
at org.apache.synapse.config.xml.AnonymousListMediator.mediate(AnonymousListMediator.java:37) ~[synapse-core_2.1.7.wso2v271_18.jar:2.1.7-wso2v271.18]
at org.apache.synapse.mediators.filters.FilterMediator.mediate(FilterMediator.java:205) ~[synapse-core_2.1.7.wso2v271_18.jar:2.1.7-wso2v271.18]
at org.apache.synapse.mediators.AbstractListMediator.mediate(AbstractListMediator.java:110) ~[synapse-core_2.1.7.wso2v271_18.jar:2.1.7-wso2v271.18]
at org.apache.synapse.mediators.AbstractListMediator.mediate(AbstractListMediator.java:72) ~[synapse-core_2.1.7.wso2v271_18.jar:2.1.7-wso2v271.18]
at org.apache.synapse.mediators.filters.InMediator.mediate(InMediator.java:74) ~[synapse-core_2.1.7.wso2v271_18.jar:2.1.7-wso2v271.18]
at org.apache.synapse.mediators.AbstractListMediator.mediate(AbstractListMediator.java:110) ~[synapse-core_2.1.7.wso2v271_18.jar:2.1.7-wso2v271.18]
at org.apache.synapse.mediators.AbstractListMediator.mediate(AbstractListMediator.java:72) ~[synapse-core_2.1.7.wso2v271_18.jar:2.1.7-wso2v271.18]
at org.apache.synapse.mediators.base.SequenceMediator.mediate(SequenceMediator.java:158) ~[synapse-core_2.1.7.wso2v271_18.jar:2.1.7-wso2v271.18]
at org.apache.synapse.core.axis2.Axis2SynapseEnvironment.injectMessage(Axis2SynapseEnvironment.java:354) ~[synapse-core_2.1.7.wso2v271_18.jar:2.1.7-wso2v271.18]
at org.apache.synapse.core.axis2.SynapseMessageReceiver.receive(SynapseMessageReceiver.java:101) ~[synapse-core_2.1.7.wso2v271_18.jar:2.1.7-wso2v271.18]
at org.apache.axis2.engine.AxisEngine.receive(AxisEngine.java:180) ~[axis2_1.6.1.wso2v80.jar:?]
at org.apache.synapse.transport.passthru.ServerWorker.processNonEntityEnclosingRESTHandler(ServerWorker.java:376) ~[synapse-nhttp-transport_2.1.7.wso2v271_17.jar:?]
at org.apache.synapse.transport.passthru.ServerWorker.processEntityEnclosingRequest(ServerWorker.java:435) ~[synapse-nhttp-transport_2.1.7.wso2v271_17.jar:?]
at org.apache.synapse.transport.passthru.ServerWorker.run(ServerWorker.java:183) ~[synapse-nhttp-transport_2.1.7.wso2v271_17.jar:?]
at org.apache.axis2.transport.base.threads.NativeWorkerPool$1.run(NativeWorkerPool.java:172) ~[axis2_1.6.1.wso2v80.jar:?]
at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1128) ~[?:?]
at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:628) ~[?:?]
at java.lang.Thread.run(Thread.java:829) [?:?]
[2023-06-21 14:48:49,861] ERROR - AnonymousListMediator Error while building message. Error while building Passthrough stream
org.apache.axis2.AxisFault: Error while building Passthrough stream
at org.apache.synapse.transport.passthru.util.RelayUtils.handleException(RelayUtils.java:453) ~[synapse-nhttp-transport_2.1.7.wso2v271_17.jar:?]
at org.apache.synapse.transport.passthru.util.RelayUtils.buildMessage(RelayUtils.java:216) ~[synapse-nhttp-transport_2.1.7.wso2v271_17.jar:?]
at org.apache.synapse.transport.passthru.util.RelayUtils.buildMessage(RelayUtils.java:122) ~[synapse-nhttp-transport_2.1.7.wso2v271_17.jar:?]
at org.apache.synapse.transport.util.PassThroughMessageHandler.buildMessage(PassThroughMessageHandler.java:103) ~[synapse-nhttp-transport_2.1.7.wso2v271_17.jar:?]
at org.apache.synapse.mediators.AbstractListMediator.buildMessage(AbstractListMediator.java:155) ~[synapse-core_2.1.7.wso2v271_18.jar:2.1.7-wso2v271.18]
at org.apache.synapse.mediators.AbstractListMediator.mediate(AbstractListMediator.java:96) ~[synapse-core_2.1.7.wso2v271_18.jar:2.1.7-wso2v271.18]
at org.apache.synapse.mediators.AbstractListMediator.mediate(AbstractListMediator.java:72) ~[synapse-core_2.1.7.wso2v271_18.jar:2.1.7-wso2v271.18]
at org.apache.synapse.config.xml.AnonymousListMediator.mediate(AnonymousListMediator.java:37) ~[synapse-core_2.1.7.wso2v271_18.jar:2.1.7-wso2v271.18]
at org.apache.synapse.mediators.filters.FilterMediator.mediate(FilterMediator.java:205) ~[synapse-core_2.1.7.wso2v271_18.jar:2.1.7-wso2v271.18]
at org.apache.synapse.mediators.AbstractListMediator.mediate(AbstractListMediator.java:110) ~[synapse-core_2.1.7.wso2v271_18.jar:2.1.7-wso2v271.18]
at org.apache.synapse.mediators.AbstractListMediator.mediate(AbstractListMediator.java:72) ~[synapse-core_2.1.7.wso2v271_18.jar:2.1.7-wso2v271.18]
at org.apache.synapse.mediators.filters.InMediator.mediate(InMediator.java:74) ~[synapse-core_2.1.7.wso2v271_18.jar:2.1.7-wso2v271.18]
at org.apache.synapse.mediators.AbstractListMediator.mediate(AbstractListMediator.java:110) ~[synapse-core_2.1.7.wso2v271_18.jar:2.1.7-wso2v271.18]
at org.apache.synapse.mediators.AbstractListMediator.mediate(AbstractListMediator.java:72) ~[synapse-core_2.1.7.wso2v271_18.jar:2.1.7-wso2v271.18]
at org.apache.synapse.mediators.base.SequenceMediator.mediate(SequenceMediator.java:158) ~[synapse-core_2.1.7.wso2v271_18.jar:2.1.7-wso2v271.18]
at org.apache.synapse.core.axis2.Axis2SynapseEnvironment.injectMessage(Axis2SynapseEnvironment.java:354) ~[synapse-core_2.1.7.wso2v271_18.jar:2.1.7-wso2v271.18]
at org.apache.synapse.core.axis2.SynapseMessageReceiver.receive(SynapseMessageReceiver.java:101) ~[synapse-core_2.1.7.wso2v271_18.jar:2.1.7-wso2v271.18]
at org.apache.axis2.engine.AxisEngine.receive(AxisEngine.java:180) ~[axis2_1.6.1.wso2v80.jar:?]
at org.apache.synapse.transport.passthru.ServerWorker.processNonEntityEnclosingRESTHandler(ServerWorker.java:376) ~[synapse-nhttp-transport_2.1.7.wso2v271_17.jar:?]
at org.apache.synapse.transport.passthru.ServerWorker.processEntityEnclosingRequest(ServerWorker.java:435) ~[synapse-nhttp-transport_2.1.7.wso2v271_17.jar:?]
at org.apache.synapse.transport.passthru.ServerWorker.run(ServerWorker.java:183) ~[synapse-nhttp-transport_2.1.7.wso2v271_17.jar:?]
at org.apache.axis2.transport.base.threads.NativeWorkerPool$1.run(NativeWorkerPool.java:172) ~[axis2_1.6.1.wso2v80.jar:?]
at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1128) ~[?:?]
at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:628) ~[?:?]
at java.lang.Thread.run(Thread.java:829) [?:?]
Caused by: org.apache.commons.fileupload.InvalidFileNameException: Invalid file name: %{(#nike='multipart/form-data').(#[email protected]@DEFAULT_MEMBER_ACCESS).(#_memberAccess?(#_memberAccess=#dm):((#container=#context['com.opensymphony.xwork2.ActionContext.container']).(#ognlUtil=#container.getInstance(@com.opensymphony.xwork2.ognl.OgnlUtil@class)).(#ognlUtil.getExcludedPackageNames().clear()).(#ognlUtil.getExcludedClasses().clear()).(#context.setMemberAccess(#dm)))).(#cmdwin='ipconfig').(#cmdlinux='ifconfig').(#iswin=(@java.lang.System@getProperty('os.name').toLowerCase().contains('win'))).(#cmds=(#iswin?{'cmd.exe','/c',#cmdwin}:{'/bin/bash','-c',#cmdlinux})).(#p=new java.lang.ProcessBuilder(#cmds)).(#p.redirectErrorStream(true)).(#process=#p.start()).(#ros=(@org.apache.struts2.ServletActionContext@getResponse().getOutputStream())).(@org.apache.commons.io.IOUtils@copy(#process.getInputStream(),#ros)).(#ros.flush())}\0b
at org.apache.commons.fileupload.util.Streams.checkFileName(Streams.java:187) ~[commons-fileupload_1.5.0.wso2v1.jar:?]
at org.apache.commons.fileupload.disk.DiskFileItem.getName(DiskFileItem.java:253) ~[commons-fileupload_1.5.0.wso2v1.jar:?]
at org.apache.axis2.builder.DiskFileDataSource.getName(DiskFileDataSource.java:46) ~[axis2_1.6.1.wso2v80.jar:?]
at org.apache.axis2.builder.BuilderUtil.addRequestParameter(BuilderUtil.java:229) ~[axis2_1.6.1.wso2v80.jar:?]
at org.apache.axis2.builder.BuilderUtil.createSOAPMessageWithoutSchema(BuilderUtil.java:211) ~[axis2_1.6.1.wso2v80.jar:?]
at org.apache.axis2.builder.BuilderUtil.buildsoapMessage(BuilderUtil.java:117) ~[axis2_1.6.1.wso2v80.jar:?]
at org.apache.axis2.builder.MultipartFormDataBuilder.processDocument(MultipartFormDataBuilder.java:93) ~[axis2_1.6.1.wso2v80.jar:?]
at org.apache.synapse.transport.passthru.util.DeferredMessageBuilder.getDocument(DeferredMessageBuilder.java:153) ~[synapse-nhttp-transport_2.1.7.wso2v271_17.jar:?]
at org.apache.synapse.transport.passthru.util.RelayUtils.buildMessage(RelayUtils.java:169) ~[synapse-nhttp-transport_2.1.7.wso2v271_17.jar:?]
... 23 more
[2023-06-21 14:48:50,027] INFO - LogMediator STATUS = Executing default 'fault' sequence, ERROR_CODE = 0, ERROR_MESSAGE = Error while building message. Error while building Passthrough stream
[2023-06-21 14:48:50,047] INFO - LogMediator STATUS = Message dispatched to the main sequence. Invalid URL., RESOURCE = /jbossmq-httpil/HTTPServerILServlet, HEALTH CHECK URL = /jbossmq-httpil/HTTPServerILServlet
[2023-06-21 14:48:50,047] ERROR - RelayUtils Error while building Passthrough stream
java.lang.StringIndexOutOfBoundsException: begin 0, end -1, length 193
at java.lang.String.checkBoundsBeginEnd(String.java:3319) ~[?:?]
at java.lang.String.substring(String.java:1874) ~[?:?]
at org.apache.synapse.commons.builders.XFormURLEncodedBuilder.extractParametersFromRequest(XFormURLEncodedBuilder.java:223) ~[synapse-commons_2.1.7.wso2v271_6.jar:?]
at org.apache.synapse.commons.builders.XFormURLEncodedBuilder.processDocumentWrapper(XFormURLEncodedBuilder.java:128) ~[synapse-commons_2.1.7.wso2v271_6.jar:?]
at org.apache.synapse.commons.builders.XFormURLEncodedBuilder.processDocument(XFormURLEncodedBuilder.java:52) ~[synapse-commons_2.1.7.wso2v271_6.jar:?]
at org.apache.synapse.transport.passthru.util.DeferredMessageBuilder.getDocument(DeferredMessageBuilder.java:153) ~[synapse-nhttp-transport_2.1.7.wso2v271_17.jar:?]
at org.apache.synapse.transport.passthru.util.RelayUtils.buildMessage(RelayUtils.java:169) ~[synapse-nhttp-transport_2.1.7.wso2v271_17.jar:?]
at org.apache.synapse.transport.passthru.util.RelayUtils.buildMessage(RelayUtils.java:122) ~[synapse-nhttp-transport_2.1.7.wso2v271_17.jar:?]
at org.apache.synapse.transport.util.PassThroughMessageHandler.buildMessage(PassThroughMessageHandler.java:103) ~[synapse-nhttp-transport_2.1.7.wso2v271_17.jar:?]
at org.apache.synapse.mediators.AbstractListMediator.buildMessage(AbstractListMediator.java:155) ~[synapse-core_2.1.7.wso2v271_18.jar:2.1.7-wso2v271.18]
at org.apache.synapse.mediators.AbstractListMediator.mediate(AbstractListMediator.java:96) ~[synapse-core_2.1.7.wso2v271_18.jar:2.1.7-wso2v271.18]
at org.apache.synapse.mediators.AbstractListMediator.mediate(AbstractListMediator.java:72) ~[synapse-core_2.1.7.wso2v271_18.jar:2.1.7-wso2v271.18]
at org.apache.synapse.config.xml.AnonymousListMediator.mediate(AnonymousListMediator.java:37) ~[synapse-core_2.1.7.wso2v271_18.jar:2.1.7-wso2v271.18]
at org.apache.synapse.mediators.filters.FilterMediator.mediate(FilterMediator.java:205) ~[synapse-core_2.1.7.wso2v271_18.jar:2.1.7-wso2v271.18]
at org.apache.synapse.mediators.AbstractListMediator.mediate(AbstractListMediator.java:110) ~[synapse-core_2.1.7.wso2v271_18.jar:2.1.7-wso2v271.18]
at org.apache.synapse.mediators.AbstractListMediator.mediate(AbstractListMediator.java:72) ~[synapse-core_2.1.7.wso2v271_18.jar:2.1.7-wso2v271.18]
at org.apache.synapse.mediators.filters.InMediator.mediate(InMediator.java:74) ~[synapse-core_2.1.7.wso2v271_18.jar:2.1.7-wso2v271.18]
at org.apache.synapse.mediators.AbstractListMediator.mediate(AbstractListMediator.java:110) ~[synapse-core_2.1.7.wso2v271_18.jar:2.1.7-wso2v271.18]
at org.apache.synapse.mediators.AbstractListMediator.mediate(AbstractListMediator.java:72) ~[synapse-core_2.1.7.wso2v271_18.jar:2.1.7-wso2v271.18]
at org.apache.synapse.mediators.base.SequenceMediator.mediate(SequenceMediator.java:158) ~[synapse-core_2.1.7.wso2v271_18.jar:2.1.7-wso2v271.18]
at org.apache.synapse.core.axis2.Axis2SynapseEnvironment.injectMessage(Axis2SynapseEnvironment.java:354) ~[synapse-core_2.1.7.wso2v271_18.jar:2.1.7-wso2v271.18]
at org.apache.synapse.core.axis2.SynapseMessageReceiver.receive(SynapseMessageReceiver.java:101) ~[synapse-core_2.1.7.wso2v271_18.jar:2.1.7-wso2v271.18]
at org.apache.axis2.engine.AxisEngine.receive(AxisEngine.java:180) ~[axis2_1.6.1.wso2v80.jar:?]
at org.apache.synapse.transport.passthru.ServerWorker.processNonEntityEnclosingRESTHandler(ServerWorker.java:376) ~[synapse-nhttp-transport_2.1.7.wso2v271_17.jar:?]
at org.apache.synapse.transport.passthru.ServerWorker.processEntityEnclosingRequest(ServerWorker.java:435) ~[synapse-nhttp-transport_2.1.7.wso2v271_17.jar:?]
at org.apache.synapse.transport.passthru.ServerWorker.run(ServerWorker.java:183) ~[synapse-nhttp-transport_2.1.7.wso2v271_17.jar:?]
at org.apache.axis2.transport.base.threads.NativeWorkerPool$1.run(NativeWorkerPool.java:172) ~[axis2_1.6.1.wso2v80.jar:?]
at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1128) ~[?:?]
at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:628) ~[?:?]
at java.lang.Thread.run(Thread.java:829) [?:?]
[2023-06-21 14:48:50,047] ERROR - AnonymousListMediator Error while building message. Error while building Passthrough stream
org.apache.axis2.AxisFault: Error while building Passthrough stream
at org.apache.synapse.transport.passthru.util.RelayUtils.handleException(RelayUtils.java:453) ~[synapse-nhttp-transport_2.1.7.wso2v271_17.jar:?]
at org.apache.synapse.transport.passthru.util.RelayUtils.buildMessage(RelayUtils.java:216) ~[synapse-nhttp-transport_2.1.7.wso2v271_17.jar:?]
at org.apache.synapse.transport.passthru.util.RelayUtils.buildMessage(RelayUtils.java:122) ~[synapse-nhttp-transport_2.1.7.wso2v271_17.jar:?]
at org.apache.synapse.transport.util.PassThroughMessageHandler.buildMessage(PassThroughMessageHandler.java:103) ~[synapse-nhttp-transport_2.1.7.wso2v271_17.jar:?]
at org.apache.synapse.mediators.AbstractListMediator.buildMessage(AbstractListMediator.java:155) ~[synapse-core_2.1.7.wso2v271_18.jar:2.1.7-wso2v271.18]
at org.apache.synapse.mediators.AbstractListMediator.mediate(AbstractListMediator.java:96) ~[synapse-core_2.1.7.wso2v271_18.jar:2.1.7-wso2v271.18]
at org.apache.synapse.mediators.AbstractListMediator.mediate(AbstractListMediator.java:72) ~[synapse-core_2.1.7.wso2v271_18.jar:2.1.7-wso2v271.18]
at org.apache.synapse.config.xml.AnonymousListMediator.mediate(AnonymousListMediator.java:37) ~[synapse-core_2.1.7.wso2v271_18.jar:2.1.7-wso2v271.18]
at org.apache.synapse.mediators.filters.FilterMediator.mediate(FilterMediator.java:205) ~[synapse-core_2.1.7.wso2v271_18.jar:2.1.7-wso2v271.18]
at org.apache.synapse.mediators.AbstractListMediator.mediate(AbstractListMediator.java:110) ~[synapse-core_2.1.7.wso2v271_18.jar:2.1.7-wso2v271.18]
at org.apache.synapse.mediators.AbstractListMediator.mediate(AbstractListMediator.java:72) ~[synapse-core_2.1.7.wso2v271_18.jar:2.1.7-wso2v271.18]
at org.apache.synapse.mediators.filters.InMediator.mediate(InMediator.java:74) ~[synapse-core_2.1.7.wso2v271_18.jar:2.1.7-wso2v271.18]
at org.apache.synapse.mediators.AbstractListMediator.mediate(AbstractListMediator.java:110) ~[synapse-core_2.1.7.wso2v271_18.jar:2.1.7-wso2v271.18]
at org.apache.synapse.mediators.AbstractListMediator.mediate(AbstractListMediator.java:72) ~[synapse-core_2.1.7.wso2v271_18.jar:2.1.7-wso2v271.18]
at org.apache.synapse.mediators.base.SequenceMediator.mediate(SequenceMediator.java:158) ~[synapse-core_2.1.7.wso2v271_18.jar:2.1.7-wso2v271.18]
at org.apache.synapse.core.axis2.Axis2SynapseEnvironment.injectMessage(Axis2SynapseEnvironment.java:354) ~[synapse-core_2.1.7.wso2v271_18.jar:2.1.7-wso2v271.18]
at org.apache.synapse.core.axis2.SynapseMessageReceiver.receive(SynapseMessageReceiver.java:101) ~[synapse-core_2.1.7.wso2v271_18.jar:2.1.7-wso2v271.18]
at org.apache.axis2.engine.AxisEngine.receive(AxisEngine.java:180) ~[axis2_1.6.1.wso2v80.jar:?]
at org.apache.synapse.transport.passthru.ServerWorker.processNonEntityEnclosingRESTHandler(ServerWorker.java:376) ~[synapse-nhttp-transport_2.1.7.wso2v271_17.jar:?]
at org.apache.synapse.transport.passthru.ServerWorker.processEntityEnclosingRequest(ServerWorker.java:435) ~[synapse-nhttp-transport_2.1.7.wso2v271_17.jar:?]
at org.apache.synapse.transport.passthru.ServerWorker.run(ServerWorker.java:183) ~[synapse-nhttp-transport_2.1.7.wso2v271_17.jar:?]
at org.apache.axis2.transport.base.threads.NativeWorkerPool$1.run(NativeWorkerPool.java:172) ~[axis2_1.6.1.wso2v80.jar:?]
at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1128) ~[?:?]
at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:628) ~[?:?]
at java.lang.Thread.run(Thread.java:829) [?:?]
Caused by: java.lang.StringIndexOutOfBoundsException: begin 0, end -1, length 193
at java.lang.String.checkBoundsBeginEnd(String.java:3319) ~[?:?]
at java.lang.String.substring(String.java:1874) ~[?:?]
at org.apache.synapse.commons.builders.XFormURLEncodedBuilder.extractParametersFromRequest(XFormURLEncodedBuilder.java:223) ~[synapse-commons_2.1.7.wso2v271_6.jar:?]
at org.apache.synapse.commons.builders.XFormURLEncodedBuilder.processDocumentWrapper(XFormURLEncodedBuilder.java:128) ~[synapse-commons_2.1.7.wso2v271_6.jar:?]
at org.apache.synapse.commons.builders.XFormURLEncodedBuilder.processDocument(XFormURLEncodedBuilder.java:52) ~[synapse-commons_2.1.7.wso2v271_6.jar:?]
at org.apache.synapse.transport.passthru.util.DeferredMessageBuilder.getDocument(DeferredMessageBuilder.java:153) ~[synapse-nhttp-transport_2.1.7.wso2v271_17.jar:?]
at org.apache.synapse.transport.passthru.util.RelayUtils.buildMessage(RelayUtils.java:169) ~[synapse-nhttp-transport_2.1.7.wso2v271_17.jar:?]
Related Issues
No response
Suggested Labels
No response
The text was updated successfully, but these errors were encountered:
Description
Hi team,
Upon a recent penetration testing of WSO2 APIM 4.1.0 (Update Level 73), we identified an issue related to error code handling when sending malformed requests to non-existent API endpoints.
As an example, when sending a request to an unavailable API endpoint (e.g., https://localhost:8243/jbossmq-httpil/HTTPServerILServlet) with a binary file (.yaml extension), the WSO2 product returns a 500 error instead of the expected 4xx error. The error code observed is ERROR_CODE=601000.
We also fixed this issue by changing the main.xml in APIM. The main.xml files which we changed can be found in the following two locations.
The following property needs to be added before the sequence goes into the filters.
<property name="message.builder.invoked" value="true" scope="axis2" type="BOOLEAN"/>
Please address this from our product level and if you require any further details or clarification, please feel free to reach out to me.
Best Regards,
Nadun.
Steps to Reproduce
Affected Component
APIM
Version
APIM 4.1.0 Update level 73
Environment Details (with versions)
No response
Relevant Log Output
Related Issues
No response
Suggested Labels
No response
The text was updated successfully, but these errors were encountered: