[
https://issues.apache.org/jira/browse/TINKERPOP-3279?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=18100903#comment-18100903
]
ASF GitHub Bot commented on TINKERPOP-3279:
-------------------------------------------
codecov-commenter commented on PR #3586:
URL: https://github.com/apache/tinkerpop/pull/3586#issuecomment-5147509059
##
[Codecov](https://app.codecov.io/gh/apache/tinkerpop/pull/3586?dropdown=coverage&src=pr&el=h1&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache)
Report
:white_check_mark: All modified and coverable lines are covered by tests.
:white_check_mark: Project coverage is 77.08%. Comparing base
([`4722890`](https://app.codecov.io/gh/apache/tinkerpop/commit/4722890ed831ba4f71c3916b5e6eafcf85439345?dropdown=coverage&el=desc&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache))
to head
([`76f5a36`](https://app.codecov.io/gh/apache/tinkerpop/commit/76f5a36adef499dd689adcc6fa62455bd48e32a8?dropdown=coverage&el=desc&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache)).
:warning: Report is 69 commits behind head on 3.7-dev.
<details><summary>Additional details and impacted files</summary>
```diff
@@ Coverage Diff @@
## 3.7-dev #3586 +/- ##
=============================================
+ Coverage 75.49% 77.08% +1.58%
=============================================
Files 1092 28 -1064
Lines 67208 5337 -61871
Branches 7391 0 -7391
=============================================
- Hits 50742 4114 -46628
+ Misses 13837 1020 -12817
+ Partials 2629 203 -2426
```
</details>
[:umbrella: View full report in Codecov by
Harness](https://app.codecov.io/gh/apache/tinkerpop/pull/3586?dropdown=coverage&src=pr&el=continue&utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache).
:loudspeaker: Have feedback on the report? [Share it
here](https://about.codecov.io/codecov-pr-comment-feedback/?utm_medium=referral&utm_source=github&utm_content=comment&utm_campaign=pr+comments&utm_term=apache).
<details><summary> :rocket: New features to boost your workflow: </summary>
- :snowflake: [Test
Analytics](https://docs.codecov.com/docs/test-analytics): Detect flaky tests,
report on failures, and find test suite problems.
- :package: [JS Bundle
Analysis](https://docs.codecov.com/docs/javascript-bundle-analysis): Save
yourself from yourself by tracking and limiting bundle sizes in JS merges.
</details>
> GraphSON 1.0 embedded types unsafe deserialization
> --------------------------------------------------
>
> Key: TINKERPOP-3279
> URL: https://issues.apache.org/jira/browse/TINKERPOP-3279
> Project: TinkerPop
> Issue Type: Bug
> Components: io
> Affects Versions: 4.0.0, 3.7.7, 3.8.2
> Reporter: Guian Gumpac
> Priority: Major
>
> GraphSON 1.0 with embedded types (`TypeInfo.PARTIAL_TYPES`) configures
> Jackson default typing with `JsonTypeInfo.Id.CLASS` and no
> `PolymorphicTypeValidator`, so reading a document reconstructs whatever class
> is named in its `@class` property.
> Affected: gremlin-core GraphSON IO (`GraphSONMapper`), consumed by `io()`,
> `GraphSONReader`, graph persistence, and the typed GraphSON 1.0 wire
> serializer `GraphSONMessageSerializerV1`
> (`application/vnd.gremlin-v1.0+json`). GraphSON 1.0 only.
> With `Id.CLASS` default typing and no validator, a `@class` value names a
> fully-qualified Java class that Jackson resolves via `Class.forName` and
> instantiates (running its constructor/setters). Reading an untrusted document
> is therefore an unsafe-deserialization sink on a classpath with a usable
> gadget it is arbitrary code execution, and even without one a crafted
> `@class` forces class loading and static-initializer execution of any class
> on the classpath.
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
