This is an automated email from the ASF dual-hosted git repository.
gangwu pushed a commit to branch master
in repository https://gitbox.apache.org/repos/asf/parquet-java.git
The following commit(s) were added to refs/heads/master by this push:
new 680edfa71 GH-3168: Restrict trusted packages in the parquet-avro
module (#3169)
680edfa71 is described below
commit 680edfa71c142d9eb63e76e5070b3713ba0cab53
Author: Gang Wu <[email protected]>
AuthorDate: Fri Mar 7 23:26:27 2025 +0800
GH-3168: Restrict trusted packages in the parquet-avro module (#3169)
---
.../org/apache/parquet/avro/AvroConverters.java | 39 ++++++++++++++++++++++
.../apache/parquet/UntrustedStringableClass.java | 32 ++++++++++++++++++
.../apache/parquet/avro/TestReflectReadWrite.java | 35 +++++++++++++++++++
3 files changed, 106 insertions(+)
diff --git
a/parquet-avro/src/main/java/org/apache/parquet/avro/AvroConverters.java
b/parquet-avro/src/main/java/org/apache/parquet/avro/AvroConverters.java
index 9b4da9e29..459449085 100644
--- a/parquet-avro/src/main/java/org/apache/parquet/avro/AvroConverters.java
+++ b/parquet-avro/src/main/java/org/apache/parquet/avro/AvroConverters.java
@@ -21,6 +21,8 @@ package org.apache.parquet.avro;
import java.lang.reflect.Constructor;
import java.lang.reflect.InvocationTargetException;
import java.nio.ByteBuffer;
+import java.util.Arrays;
+import java.util.List;
import org.apache.avro.Schema;
import org.apache.avro.generic.GenericData;
import org.apache.avro.util.Utf8;
@@ -34,6 +36,15 @@ import org.apache.parquet.schema.PrimitiveType;
public class AvroConverters {
+ public static final String[] SERIALIZABLE_PACKAGES;
+
+ static {
+ SERIALIZABLE_PACKAGES = System.getProperty(
+ "org.apache.parquet.avro.SERIALIZABLE_PACKAGES",
+ "java.lang,java.math,java.io,java.net,org.apache.parquet.avro")
+ .split(",");
+ }
+
public abstract static class AvroGroupConverter extends GroupConverter {
protected final ParentValueContainer parent;
@@ -261,6 +272,7 @@ public class AvroConverters {
public FieldStringableConverter(ParentValueContainer parent, Class<?>
stringableClass) {
super(parent);
+ checkSecurity(stringableClass);
stringableName = stringableClass.getName();
try {
this.ctor = stringableClass.getConstructor(String.class);
@@ -277,6 +289,33 @@ public class AvroConverters {
throw new ParquetDecodingException("Cannot convert binary to " +
stringableName, e);
}
}
+
+ private void checkSecurity(Class<?> clazz) throws SecurityException {
+ List<String> trustedPackages = Arrays.asList(SERIALIZABLE_PACKAGES);
+
+ boolean trustAllPackages = trustedPackages.size() == 1 &&
"*".equals(trustedPackages.get(0));
+ if (trustAllPackages || clazz.isPrimitive()) {
+ return;
+ }
+
+ boolean found = false;
+ Package thePackage = clazz.getPackage();
+ if (thePackage != null) {
+ for (String trustedPackage : trustedPackages) {
+ if (thePackage.getName().equals(trustedPackage)
+ || thePackage.getName().startsWith(trustedPackage + ".")) {
+ found = true;
+ break;
+ }
+ }
+ if (!found) {
+ throw new SecurityException("Forbidden " + clazz
+ + "! This class is not trusted to be included in Avro schema
using java-class."
+ + " Please set org.apache.parquet.avro.SERIALIZABLE_PACKAGES
system property"
+ + " with the packages you trust.");
+ }
+ }
+ }
}
static final class FieldEnumConverter extends BinaryConverter<Object> {
diff --git
a/parquet-avro/src/test/java/org/apache/parquet/UntrustedStringableClass.java
b/parquet-avro/src/test/java/org/apache/parquet/UntrustedStringableClass.java
new file mode 100644
index 000000000..abdeeb129
--- /dev/null
+++
b/parquet-avro/src/test/java/org/apache/parquet/UntrustedStringableClass.java
@@ -0,0 +1,32 @@
+/**
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements. See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership. The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License. You may obtain a copy of the License at
+ * <p>
+ * http://www.apache.org/licenses/LICENSE-2.0
+ * <p>
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied. See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+package org.apache.parquet;
+
+public class UntrustedStringableClass {
+ private final String value;
+
+ public UntrustedStringableClass(String value) {
+ this.value = value;
+ }
+
+ @Override
+ public String toString() {
+ return this.value;
+ }
+}
diff --git
a/parquet-avro/src/test/java/org/apache/parquet/avro/TestReflectReadWrite.java
b/parquet-avro/src/test/java/org/apache/parquet/avro/TestReflectReadWrite.java
index 5b6260e11..2acd827ad 100644
---
a/parquet-avro/src/test/java/org/apache/parquet/avro/TestReflectReadWrite.java
+++
b/parquet-avro/src/test/java/org/apache/parquet/avro/TestReflectReadWrite.java
@@ -37,6 +37,7 @@ import org.apache.avro.reflect.Stringable;
import org.apache.avro.util.Utf8;
import org.apache.hadoop.conf.Configuration;
import org.apache.hadoop.fs.Path;
+import org.apache.parquet.UntrustedStringableClass;
import org.apache.parquet.hadoop.ParquetReader;
import org.apache.parquet.hadoop.ParquetWriter;
import org.apache.parquet.hadoop.metadata.CompressionCodecName;
@@ -76,6 +77,40 @@ public class TestReflectReadWrite {
}
}
+ @Test(expected = SecurityException.class)
+ public void testUntrustedStringableClass() {
+ new AvroConverters.FieldStringableConverter(
+ new ParentValueContainer() {
+ @Override
+ public void add(Object value) {}
+
+ @Override
+ public void addBoolean(boolean value) {}
+
+ @Override
+ public void addInt(int value) {}
+
+ @Override
+ public void addLong(long value) {}
+
+ @Override
+ public void addFloat(float value) {}
+
+ @Override
+ public void addDouble(double value) {}
+
+ @Override
+ public void addChar(char value) {}
+
+ @Override
+ public void addByte(byte value) {}
+
+ @Override
+ public void addShort(short value) {}
+ },
+ UntrustedStringableClass.class);
+ }
+
private GenericRecord getGenericPojoUtf8() {
Schema schema = ReflectData.get().getSchema(Pojo.class);
GenericData.Record record = new GenericData.Record(schema);
