[
https://issues.apache.org/jira/browse/TINKERPOP-3279?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=18107666#comment-18107666
]
ASF GitHub Bot commented on TINKERPOP-3279:
-------------------------------------------
kenhuuu commented on code in PR #3586:
URL: https://github.com/apache/tinkerpop/pull/3586#discussion_r3849845655
##########
gremlin-core/src/main/java/org/apache/tinkerpop/gremlin/structure/io/graphson/GraphSONMapper.java:
##########
@@ -288,6 +492,18 @@ public Builder typeInfo(final TypeInfo typeInfo) {
return this;
}
+ /**
+ * Adds a class-name prefix that GraphSON 1.0 embedded-type
deserialization will accept in a {@code @class}
+ * property, in addition to the safe defaults ({@code java.lang.},
{@code java.util.}, {@code java.math.},
+ * {@code java.time.}, {@code org.apache.tinkerpop.} and array types).
Use this to re-enable a provider or
+ * application type read from trusted input; a graph document from an
untrusted source should not be granted
+ * additional prefixes. Has no effect on GraphSON 2.0 or 3.0, which
resolve types through a fixed registry.
+ */
+ public Builder addAllowedTypeIdPrefix(final String... prefixes) {
Review Comment:
Should this have a matching denyTypeIdPrefix() in case the current allowed
list is too permissive?
> GraphSON 1.0 embedded types unsafe deserialization
> --------------------------------------------------
>
> Key: TINKERPOP-3279
> URL: https://issues.apache.org/jira/browse/TINKERPOP-3279
> Project: TinkerPop
> Issue Type: Bug
> Components: io
> Affects Versions: 4.0.0, 3.7.7, 3.8.2
> Reporter: Guian Gumpac
> Priority: Major
>
> GraphSON 1.0 with embedded types (`TypeInfo.PARTIAL_TYPES`) configures
> Jackson default typing with `JsonTypeInfo.Id.CLASS` and no
> `PolymorphicTypeValidator`, so reading a document reconstructs whatever class
> is named in its `@class` property.
> Affected: gremlin-core GraphSON IO (`GraphSONMapper`), consumed by `io()`,
> `GraphSONReader`, graph persistence, and the typed GraphSON 1.0 wire
> serializer `GraphSONMessageSerializerV1`
> (`application/vnd.gremlin-v1.0+json`). GraphSON 1.0 only.
> With `Id.CLASS` default typing and no validator, a `@class` value names a
> fully-qualified Java class that Jackson resolves via `Class.forName` and
> instantiates (running its constructor/setters). Reading an untrusted document
> is therefore an unsafe-deserialization sink on a classpath with a usable
> gadget it is arbitrary code execution, and even without one a crafted
> `@class` forces class loading and static-initializer execution of any class
> on the classpath.
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
