xiaoqin.fu created THRIFT-4929:
----------------------------------
Summary: Sensitive information about socket input stream or output
stream is leaked from TIOStreamTransport
Key: THRIFT-4929
URL: https://issues.apache.org/jira/browse/THRIFT-4929
Project: Thrift
Issue Type: Bug
Components: Java - Library
Affects Versions: 0.12.0, 0.11.0
Environment: Ubuntu 16.04.3 LTS
Open JDK version "1.8.0_191" build 25.191-b12
Reporter: xiaoqin.fu
Attachments: TaintPath
The source: org.apache.thrift.transport.TIOStreamTransport:
public int read(byte[] buf, int off, int len) throws TTransportException {
if (inputStream_ == null) {
throw new TTransportException(TTransportException.NOT_OPEN, "Cannot read
from null inputStream");
}
int bytesRead;
......
bytesRead = inputStream_.read(buf, off, len);
......
}
The sink: org.apache.thrift.transport.TIOStreamTransport,
public void close() {
if (inputStream_ != null) {
try {
inputStream_.close();
} catch (IOException iox) {
LOGGER.warn("Error closing input stream.", iox);
}
inputStream_ = null;
}
if (outputStream_ != null) {
try {
outputStream_.close();
} catch (IOException iox) {
LOGGER.warn("Error closing output stream.", iox);
}
outputStream_ = null;
}
}
Sensitive information about socket input stream or output stream is leaked.
The tainted path:
org.apache.thrift.transport.TIOStreamTransport -->
org.apache.thrift.transport.TTransport -->
org.apache.thrift.protocol.TBinaryProtocol -->
org.apache.thrift.transport.TTransport -->
org.apache.thrift.protocol.TBinaryProtocol -->
org.apache.thrift.transport.TTransport -->
org.apache.thrift.protocol.TBinaryProtocol -->
org.apache.thrift.transport.TTransport -->
org.apache.thrift.protocol.TBinaryProtocol -->
org.apache.thrift.transport.TTransport -->
org.apache.thrift.protocol.TBinaryProtocol -->
org.apache.thrift.transport.TTransport -->
org.apache.thrift.protocol.TBinaryProtocol -->
org.apache.thrift.transport.TTransport -->
CalculatorService$add_result$add_resultStandardScheme -->
org.apache.thrift.protocol.TBinaryProtocol -->
org.apache.thrift.TServiceClient -->
org.apache.thrift.protocol.TBinaryProtocol -->
org.apache.thrift.transport.TIOStreamTransport -->
CalculatorService$add_result$add_resultStandardScheme -->
org.apache.thrift.protocol.TBinaryProtocol -->
org.apache.thrift.transport.TIOStreamTransport -->
CalculatorService$add_result$add_resultStandardScheme -->
org.apache.thrift.protocol.TBinaryProtocol -->
CalculatorService$Client -->
org.apache.thrift.protocol.TMessage -->
org.apache.thrift.protocol.TField -->
org.apache.thrift.protocol.TBinaryProtocol -->
CalculatorService$add_result$add_resultStandardScheme -->
org.apache.thrift.protocol.TBinaryProtocol -->
CalculatorService$add_result$add_resultStandardScheme -->
org.apache.thrift.protocol.TBinaryProtocol -->
org.apache.thrift.protocol.TField -->
CalculatorService$Client -->
org.apache.thrift.protocol.TBinaryProtocol -->
CalculatorService$add_result -->
org.apache.thrift.TServiceClient -->
org.apache.thrift.protocol.TBinaryProtocol -->
org.apache.thrift.TServiceClient -->
org.apache.thrift.protocol.TField -->
CalculatorService$add_result$add_resultStandardScheme -->
org.apache.thrift.protocol.TBinaryProtocol -->
CalculatorService$Client -->
org.apache.thrift.protocol.TBinaryProtocol -->
CalculatorService$Client -->
org.apache.thrift.protocol.TBinaryProtocol -->
org.apache.thrift.protocol.TMessage -->
org.apache.thrift.protocol.TBinaryProtocol -->
org.apache.thrift.TServiceClient -->
org.apache.thrift.protocol.TBinaryProtocol -->
org.apache.thrift.TServiceClient -->
org.apache.thrift.protocol.TBinaryProtocol -->
CalculatorService$add_result$add_resultStandardScheme -->
org.apache.thrift.protocol.TBinaryProtocol -->
org.apache.thrift.protocol.TMessage -->
CalculatorService$add_result$add_resultStandardScheme -->
CalculatorService$add_args -->
org.apache.thrift.protocol.TBinaryProtocol -->
CalculatorService$add_result -->
CalculatorService$add_args -->
org.apache.thrift.TServiceClient -->
CalculatorService$add_result -->
org.apache.thrift.protocol.TBinaryProtocol -->
CalculatorService$add_args -->
CalculatorService$add_result$add_resultStandardScheme -->
CalculatorService$add_result -->
org.apache.thrift.EncodingUtils -->
CalculatorClient -->
CalculatorService$add_result -->
org.apache.thrift.protocol.TBinaryProtocol -->
org.apache.thrift.TServiceClient -->
org.apache.thrift.protocol.TBinaryProtocol -->
CalculatorService$add_result -->
org.apache.thrift.protocol.TBinaryProtocol -->
org.apache.thrift.EncodingUtils -->
org.apache.thrift.protocol.TBinaryProtocol -->
org.apache.thrift.EncodingUtils -->
org.apache.thrift.protocol.TBinaryProtocol -->
org.apache.thrift.EncodingUtils -->
CalculatorService$add_args -->
CalculatorService$add_args$add_argsStandardSchemeFactory -->
CalculatorClient -->
org.apache.thrift.protocol.TBinaryProtocol -->
CalculatorService$add_result$add_resultStandardSchemeFactory -->
CalculatorService$add_result -->
org.apache.thrift.protocol.TBinaryProtocol -->
CalculatorClient -->
org.apache.thrift.protocol.TBinaryProtocol -->
CalculatorService$add_args -->
org.apache.thrift.protocol.TBinaryProtocol -->
CalculatorService$add_args -->
org.apache.thrift.protocol.TBinaryProtocol -->
CalculatorClient -->
CalculatorService$add_result -->
org.apache.thrift.protocol.TBinaryProtocol -->
org.apache.thrift.transport.TSocket -->
org.apache.thrift.protocol.TBinaryProtocol -->
org.apache.thrift.transport.TIOStreamTransport -->
org.apache.thrift.protocol.TBinaryProtocol -->
org.apache.thrift.transport.TIOStreamTransport -->
CalculatorClient -->
CalculatorService$Client -->
CalculatorService$add_args -->
CalculatorService$add_result -->
org.apache.thrift.protocol.TBinaryProtocol -->
CalculatorClient -->
CalculatorService$add_result -->
org.apache.thrift.protocol.TBinaryProtocol -->
org.apache.thrift.transport.TIOStreamTransport -->
org.apache.thrift.protocol.TBinaryProtocol -->
org.apache.thrift.protocol.TProtocol -->
org.apache.thrift.protocol.TBinaryProtocol -->
org.apache.thrift.TServiceClient -->
org.apache.thrift.transport.TIOStreamTransport -->
CalculatorService$Client -->
CalculatorClient -->
org.apache.thrift.transport.TSocket -->
CalculatorClient -->
org.apache.thrift.protocol.TBinaryProtocol -->
CalculatorClient -->
org.apache.thrift.EncodingUtils -->
CalculatorService$Client -->
org.apache.thrift.transport.TSocket -->
org.apache.thrift.protocol.TBinaryProtocol -->
org.apache.thrift.transport.TIOStreamTransport -->
org.apache.thrift.protocol.TBinaryProtocol -->
org.apache.thrift.transport.TIOStreamTransport -->
org.apache.thrift.EncodingUtils -->
org.apache.thrift.transport.TIOStreamTransport -->
org.apache.thrift.protocol.TBinaryProtocol -->
org.apache.thrift.transport.TSocket -->
org.apache.thrift.protocol.TProtocol -->
org.apache.thrift.TServiceClient -->
org.apache.thrift.transport.TSocket -->
org.apache.thrift.protocol.TBinaryProtocol -->
org.apache.thrift.transport.TSocket -->
org.apache.thrift.protocol.TBinaryProtocol -->
org.apache.thrift.EncodingUtils -->
org.apache.thrift.transport.TIOStreamTransport -->
org.apache.thrift.protocol.TBinaryProtocol -->
org.apache.thrift.transport.TSocket -->
org.apache.thrift.protocol.TBinaryProtocol -->
org.apache.thrift.transport.TSocket -->
org.apache.thrift.protocol.TBinaryProtocol -->
CalculatorClient -->
org.apache.thrift.protocol.TBinaryProtocol -->
org.apache.thrift.transport.TIOStreamTransport -->
--
This message was sent by Atlassian JIRA
(v7.6.14#76016)
