[
https://issues.apache.org/jira/browse/TINKERPOP-3279?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=18107672#comment-18107672
]
ASF GitHub Bot commented on TINKERPOP-3279:
-------------------------------------------
kenhuuu commented on code in PR #3586:
URL: https://github.com/apache/tinkerpop/pull/3586#discussion_r3849861232
##########
gremlin-core/src/test/java/com/example/gadget/GraphSONTestGadgets.java:
##########
@@ -0,0 +1,101 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements. See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership. The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License. You may obtain a copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied. See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+package com.example.gadget;
+
+import java.util.Objects;
+
+/**
+ * Test-only types in a package outside every allowlisted GraphSON 1.0 type
prefix, used to exercise the
+ * GraphSON 1.0 embedded-type restriction and its {@code
addAllowedTypeIdPrefix(...)} opt-out.
+ */
+public final class GraphSONTestGadgets {
+
+ private GraphSONTestGadgets() {
+ }
+
+ /**
+ * Records execution of its static initializer through a system property,
so a test can observe whether the
+ * class was loaded/initialized without referencing it (which would itself
trigger initialization).
+ */
+ public static class StaticInitCanary {
+ public static final String FIRED_PROPERTY =
"tinkerpop.test.graphson.staticInitCanary";
+ static {
+ System.setProperty(FIRED_PROPERTY, "fired");
+ }
+ public int x;
+ }
+
+ /**
+ * A plain bean with no static-initializer side effect, used to verify the
opt-out re-enables a trusted type.
+ */
+ public static class SamplePojo {
+ public int x;
+
+ public SamplePojo() {
+ }
+
+ public SamplePojo(final int x) {
+ this.x = x;
+ }
+
+ @Override
+ public boolean equals(final Object o) {
+ return o instanceof SamplePojo && ((SamplePojo) o).x == this.x;
+ }
+
+ @Override
+ public int hashCode() {
+ return Objects.hashCode(x);
+ }
+ }
+
+ /**
+ * Enum counterpart of {@link StaticInitCanary}, used to verify an enum
named as a generic type argument is
+ * refused before it is loaded (Jackson otherwise skips validation of enum
type arguments).
+ */
+ public enum StaticInitCanaryEnum {
+ A, B;
+ public static final String FIRED_PROPERTY =
"tinkerpop.test.graphson.staticInitCanaryEnum";
+ static {
+ System.setProperty(FIRED_PROPERTY, "fired");
+ }
+ }
+
+ /**
+ * Canary used to verify a disallowed class named as a generic type
argument is not loaded when refused.
+ */
+ public static class StaticInitCanaryArg {
Review Comment:
Nit: maybe a short comment about why this `StaticInitCanaryArg` and
`StaticInitCanaryValue` both need to exist. From a first glance it looks like
the same class, but I'm guessing this has to do with static initialization?
> GraphSON 1.0 embedded types unsafe deserialization
> --------------------------------------------------
>
> Key: TINKERPOP-3279
> URL: https://issues.apache.org/jira/browse/TINKERPOP-3279
> Project: TinkerPop
> Issue Type: Bug
> Components: io
> Affects Versions: 4.0.0, 3.7.7, 3.8.2
> Reporter: Guian Gumpac
> Priority: Major
>
> GraphSON 1.0 with embedded types (`TypeInfo.PARTIAL_TYPES`) configures
> Jackson default typing with `JsonTypeInfo.Id.CLASS` and no
> `PolymorphicTypeValidator`, so reading a document reconstructs whatever class
> is named in its `@class` property.
> Affected: gremlin-core GraphSON IO (`GraphSONMapper`), consumed by `io()`,
> `GraphSONReader`, graph persistence, and the typed GraphSON 1.0 wire
> serializer `GraphSONMessageSerializerV1`
> (`application/vnd.gremlin-v1.0+json`). GraphSON 1.0 only.
> With `Id.CLASS` default typing and no validator, a `@class` value names a
> fully-qualified Java class that Jackson resolves via `Class.forName` and
> instantiates (running its constructor/setters). Reading an untrusted document
> is therefore an unsafe-deserialization sink on a classpath with a usable
> gadget it is arbitrary code execution, and even without one a crafted
> `@class` forces class loading and static-initializer execution of any class
> on the classpath.
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
