Skip to content

Commit bade479

Browse files
cowtowncodercowtowncoder
committed
Merge branch '2.7' into 2.8
2 parents 10fe7f1 + 6743953 commit bade479

File tree

3 files changed

+105
-56
lines changed

3 files changed

+105
-56
lines changed

‎release-notes/VERSION

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -15,7 +15,7 @@ Project: jackson-databind
1515
(reported by henryptung@github)
1616
#1807: Jackson-databind caches plain map deserializer and use it even map has `@JsonDeserializer`
1717
(reported by lexas2509@github)
18-
#1855: More blacklisting of serialization gadgets
18+
#1855: Blacklist for more serialization gadgets (dbcp/tomcat, spring)
1919

2020
2.8.10 (24-Aug-2017)
2121

‎src/main/java/com/fasterxml/jackson/databind/deser/BeanDeserializerFactory.java

Lines changed: 6 additions & 55 deletions
Original file line numberDiff line numberDiff line change
@@ -12,6 +12,8 @@
1212
import com.fasterxml.jackson.databind.deser.std.ThrowableDeserializer;
1313
import com.fasterxml.jackson.databind.introspect.*;
1414
import com.fasterxml.jackson.databind.jsontype.TypeDeserializer;
15+
import com.fasterxml.jackson.databind.jsontype.impl.SubTypeValidator;
16+
import com.fasterxml.jackson.databind.util.ArrayBuilders;
1517
import com.fasterxml.jackson.databind.util.ClassUtil;
1618
import com.fasterxml.jackson.databind.util.SimpleBeanPropertyDefinition;
1719

@@ -39,50 +41,6 @@ public class BeanDeserializerFactory
3941

4042
private final static Class<?>[] NO_VIEWS = new Class<?>[0];
4143

42-
/**
43-
* Set of well-known "nasty classes", deserialization of which is considered dangerous
44-
* and should (and is) prevented by default.
45-
*
46-
* @since 2.8.9
47-
*/
48-
protected final static Set<String> DEFAULT_NO_DESER_CLASS_NAMES;
49-
static {
50-
Set<String> s = new HashSet<>();
51-
// Courtesy of [https://github.com/kantega/notsoserial]:
52-
// (and wrt [databind#1599])
53-
s.add("org.apache.commons.collections.functors.InvokerTransformer");
54-
s.add("org.apache.commons.collections.functors.InstantiateTransformer");
55-
s.add("org.apache.commons.collections4.functors.InvokerTransformer");
56-
s.add("org.apache.commons.collections4.functors.InstantiateTransformer");
57-
s.add("org.codehaus.groovy.runtime.ConvertedClosure");
58-
s.add("org.codehaus.groovy.runtime.MethodClosure");
59-
s.add("org.springframework.beans.factory.ObjectFactory");
60-
s.add("com.sun.org.apache.xalan.internal.xsltc.trax.TemplatesImpl");
61-
s.add("org.apache.xalan.xsltc.trax.TemplatesImpl");
62-
// [databind#1680]: may or may not be problem, take no chance
63-
s.add("com.sun.rowset.JdbcRowSetImpl");
64-
// [databind#1737]; JDK provided
65-
s.add("java.util.logging.FileHandler");
66-
s.add("java.rmi.server.UnicastRemoteObject");
67-
// [databind#1737]; 3rd party
68-
s.add("org.springframework.aop.support.AbstractBeanFactoryPointcutAdvisor");
69-
s.add("org.springframework.beans.factory.config.PropertyPathFactoryBean");
70-
s.add("com.mchange.v2.c3p0.JndiRefForwardingDataSource");
71-
s.add("com.mchange.v2.c3p0.WrapperConnectionPoolDataSource");
72-
73-
// [databind#1855]: more 3rd party
74-
s.add("org.apache.tomcat.dbcp.dbcp2.BasicDataSource");
75-
s.add("com.sun.org.apache.bcel.internal.util.ClassLoader");
76-
DEFAULT_NO_DESER_CLASS_NAMES = Collections.unmodifiableSet(s);
77-
}
78-
79-
/**
80-
* Set of class names of types that are never to be deserialized.
81-
*
82-
* @since 2.8.9
83-
*/
84-
protected Set<String> _cfgIllegalClassNames = DEFAULT_NO_DESER_CLASS_NAMES;
85-
8644
/*
8745
/**********************************************************
8846
/* Life-cycle
@@ -182,7 +140,7 @@ public JsonDeserializer<Object> createBeanDeserializer(DeserializationContext ct
182140
return null;
183141
}
184142
// For checks like [databind#1599]
185-
checkIllegalTypes(ctxt, type, beanDesc);
143+
_validateSubType(ctxt, type, beanDesc);
186144
// Use generic bean introspection to build deserializer
187145
return buildBeanDeserializer(ctxt, type, beanDesc);
188146
}
@@ -900,19 +858,12 @@ protected boolean isIgnorableType(DeserializationConfig config, BeanDescription
900858
}
901859

902860
/**
903-
* @since 2.8.9
861+
* @since 2.8.11
904862
*/
905-
protected void checkIllegalTypes(DeserializationContext ctxt, JavaType type,
863+
protected void _validateSubType(DeserializationContext ctxt, JavaType type,
906864
BeanDescription beanDesc)
907865
throws JsonMappingException
908866
{
909-
// There are certain nasty classes that could cause problems, mostly
910-
// via default typing -- catch them here.
911-
String full = type.getRawClass().getName();
912-
913-
if (_cfgIllegalClassNames.contains(full)) {
914-
ctxt.reportBadTypeDefinition(beanDesc,
915-
"Illegal type (%s) to deserialize: prevented for security reasons", full);
916-
}
867+
SubTypeValidator.instance().validateSubType(ctxt, type);
917868
}
918869
}

‎src/main/java/com/fasterxml/jackson/databind/jsontype/impl/SubTypeValidator.java

Lines changed: 98 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,98 @@
1+
package com.fasterxml.jackson.databind.jsontype.impl;
2+
3+
import java.util.Collections;
4+
import java.util.HashSet;
5+
import java.util.Set;
6+
7+
import com.fasterxml.jackson.databind.DeserializationContext;
8+
import com.fasterxml.jackson.databind.JavaType;
9+
import com.fasterxml.jackson.databind.JsonMappingException;
10+
11+
/**
12+
* Helper class used to encapsulate rules that determine subtypes that
13+
* are invalid to use, even with default typing, mostly due to security
14+
* concerns.
15+
* Used by <code>BeanDeserializerFacotry</code>
16+
*
17+
* @since 2.8.11
18+
*/
19+
public class SubTypeValidator
20+
{
21+
protected final static String PREFIX_STRING = "org.springframework.";
22+
/**
23+
* Set of well-known "nasty classes", deserialization of which is considered dangerous
24+
* and should (and is) prevented by default.
25+
*/
26+
protected final static Set<String> DEFAULT_NO_DESER_CLASS_NAMES;
27+
static {
28+
Set<String> s = new HashSet<String>();
29+
// Courtesy of [https://github.com/kantega/notsoserial]:
30+
// (and wrt [databind#1599])
31+
s.add("org.apache.commons.collections.functors.InvokerTransformer");
32+
s.add("org.apache.commons.collections.functors.InstantiateTransformer");
33+
s.add("org.apache.commons.collections4.functors.InvokerTransformer");
34+
s.add("org.apache.commons.collections4.functors.InstantiateTransformer");
35+
s.add("org.codehaus.groovy.runtime.ConvertedClosure");
36+
s.add("org.codehaus.groovy.runtime.MethodClosure");
37+
s.add("org.springframework.beans.factory.ObjectFactory");
38+
s.add("com.sun.org.apache.xalan.internal.xsltc.trax.TemplatesImpl");
39+
s.add("org.apache.xalan.xsltc.trax.TemplatesImpl");
40+
// [databind#1680]: may or may not be problem, take no chance
41+
s.add("com.sun.rowset.JdbcRowSetImpl");
42+
// [databind#1737]; JDK provided
43+
s.add("java.util.logging.FileHandler");
44+
s.add("java.rmi.server.UnicastRemoteObject");
45+
// [databind#1737]; 3rd party
46+
//s.add("org.springframework.aop.support.AbstractBeanFactoryPointcutAdvisor"); // deprecated by [databind#1855]
47+
s.add("org.springframework.beans.factory.config.PropertyPathFactoryBean");
48+
s.add("com.mchange.v2.c3p0.JndiRefForwardingDataSource");
49+
s.add("com.mchange.v2.c3p0.WrapperConnectionPoolDataSource");
50+
// [databind#1855]: more 3rd party
51+
s.add("org.apache.tomcat.dbcp.dbcp2.BasicDataSource");
52+
s.add("com.sun.org.apache.bcel.internal.util.ClassLoader");
53+
DEFAULT_NO_DESER_CLASS_NAMES = Collections.unmodifiableSet(s);
54+
}
55+
56+
/**
57+
* Set of class names of types that are never to be deserialized.
58+
*/
59+
protected Set<String> _cfgIllegalClassNames = DEFAULT_NO_DESER_CLASS_NAMES;
60+
61+
private final static SubTypeValidator instance = new SubTypeValidator();
62+
63+
protected SubTypeValidator() { }
64+
65+
public static SubTypeValidator instance() { return instance; }
66+
67+
public void validateSubType(DeserializationContext ctxt, JavaType type) throws JsonMappingException
68+
{
69+
// There are certain nasty classes that could cause problems, mostly
70+
// via default typing -- catch them here.
71+
final Class<?> raw = type.getRawClass();
72+
String full = raw.getName();
73+
74+
do {
75+
if (_cfgIllegalClassNames.contains(full)) {
76+
break;
77+
}
78+
79+
// 18-Dec-2017, tatu: As per [databind#1855], need bit more sophisticated handling
80+
// for some Spring framework types
81+
if (full.startsWith(PREFIX_STRING)) {
82+
for (Class<?> cls = raw; cls != Object.class; cls = cls.getSuperclass()) {
83+
String name = cls.getSimpleName();
84+
// looking for "AbstractBeanFactoryPointcutAdvisor" but no point to allow any is there?
85+
if ("AbstractPointcutAdvisor".equals(name)
86+
// ditto for "FileSystemXmlApplicationContext": block all ApplicationContexts
87+
|| "AbstractApplicationContext.equals".equals(name)) {
88+
break;
89+
}
90+
}
91+
}
92+
return;
93+
} while (false);
94+
95+
throw JsonMappingException.from(ctxt,
96+
String.format("Illegal type (%s) to deserialize: prevented for security reasons", full));
97+
}
98+
}

0 commit comments

Comments
 (0)