Introduced protections against deserialization attacks #3

pixeebot · 2024-04-16T06:03:32Z

User description

This change hardens Java deserialization operations against attack. Even a simple operation like an object deserialization is an opportunity to yield control of your system to an attacker. In fact, without specific, non-default protections, any object deserialization call can lead to arbitrary code execution. The JavaDoc now even says:

Deserialization of untrusted data is inherently dangerous and should be avoided.

Let's discuss the attack. In Java, types can customize how they should be deserialized by specifying a readObject() method like this real example from an old version of Spring:

static class MethodInvokeTypeProvider implements TypeProvider {
    private final TypeProvider provider;
    private final String methodName;

    private void readObject(ObjectInputStream inputStream) {
        inputStream.defaultReadObject();
        Method method = ReflectionUtils.findMethod(
                this.provider.getType().getClass(),
                this.methodName
        );
        this.result = ReflectionUtils.invokeMethod(method,this.provider.getType());
    }
}

Reflecting on this code reveals a terrifying conclusion. If an attacker presents this object to be deserialized by your app, the runtime will take a class and a method name from the attacker and then call them. Note that an attacker can provide any serliazed type -- it doesn't have to be the one you're expecting, and it will still deserialize.

Attackers can repurpose the logic of selected types within the Java classpath (called "gadgets") and chain them together to achieve arbitrary remote code execution. There are a limited number of publicly known gadgets that can be used for attack, and our change simply inserts an ObjectInputFilter into the ObjectInputStream to prevent them from being used.

+ import io.github.pixee.security.ObjectInputFilters;
  ObjectInputStream ois = new ObjectInputStream(is);
+ ObjectInputFilters.enableObjectFilterIfUnprotected(ois);
  AcmeObject acme = (AcmeObject)ois.readObject();

This is a tough vulnerability class to understand, but it is deadly serious. It offers the highest impact possible (remote code execution), it's a common vulnerability (it's in the OWASP Top 10), and exploitation is easy enough that automated exploitation is possible. It's best to remove deserialization entirely, but our protections is effective against all known exploitation strategies.

Description

Introduced ObjectInputFilters to enhance security against deserialization attacks in CountrySchemaSql and RainbowFishSerializer.
Added java-security-toolkit as a new dependency in the project's main pom.xml and in the specific modules serialized-entity and tolerant-reader.

Changes walkthrough

Relevant files

Enhancement

CountrySchemaSql.java `Harden Java Deserialization in CountrySchemaSql` serialized-entity/src/main/java/com/iluwatar/serializedentity/CountrySchemaSql.java Added import for `ObjectInputFilters`. Inserted a call to `ObjectInputFilters.enableObjectFilterIfUnprotected` to harden deserialization.	+2/-0
RainbowFishSerializer.java `Harden Java Deserialization in RainbowFishSerializer` tolerant-reader/src/main/java/com/iluwatar/tolerantreader/RainbowFishSerializer.java Added import for `ObjectInputFilters`. Inserted a call to `ObjectInputFilters.enableObjectFilterIfUnprotected` to harden deserialization.	+2/-0

Dependencies

pom.xml `Add Java Security Toolkit Dependency in pom.xml` pom.xml Added `java-security-toolkit` version property. Included `java-security-toolkit` as a dependency.	+7/-0
pom.xml `Include Java Security Toolkit Dependency` serialized-entity/pom.xml Added `java-security-toolkit` as a dependency.	+4/-0
pom.xml `Include Java Security Toolkit Dependency` tolerant-reader/pom.xml Added `java-security-toolkit` as a dependency.	+4/-0

💡 Usage Guide

Checking Your Pull Request

Every time you make a pull request, our system automatically looks through it. We check for security issues, mistakes in how you're setting up your infrastructure, and common code problems. We do this to make sure your changes are solid and won't cause any trouble later.

Talking to CodeAnt AI

Got a question or need a hand with something in your pull request? You can easily get in touch with CodeAnt AI right here. Just type the following in a comment on your pull request, and replace "Your question here" with whatever you want to ask:

@codeant-ai ask: Your question here

This lets you have a chat with CodeAnt AI about your pull request, making it easier to understand and improve your code.

Check Your Repository Health

To analyze the health of your code repository, visit our dashboard at app.codeant.ai. This tool helps you identify potential issues and areas for improvement in your codebase, ensuring your repository maintains high standards of code health.

pixeebot · 2024-04-16T06:03:33Z

serialized-entity/pom.xml

            <groupId>com.h2database</groupId>
            <artifactId>h2</artifactId>
        </dependency>
+        <dependency>


This library holds security tools for protecting Java API calls.

License: MIT ✅ | Open source ✅ | More facts

pixeebot · 2024-04-16T06:03:34Z

pom.xml

        <artifactId>system-lambda</artifactId>
        <version>${system-lambda.version}</version>
        <scope>test</scope>
      </dependency>


This library holds security tools for protecting Java API calls.

License: MIT ✅ | Open source ✅ | More facts

pixeebot · 2024-04-16T06:03:34Z

tolerant-reader/pom.xml

      <artifactId>junit-jupiter-engine</artifactId>
      <scope>test</scope>
    </dependency>
+    <dependency>


This library holds security tools for protecting Java API calls.

License: MIT ✅ | Open source ✅ | More facts

pixeebot · 2024-04-16T06:03:35Z

pom.xml

+      <dependency>
+        <groupId>io.github.pixee</groupId>
+        <artifactId>java-security-toolkit</artifactId>
+


This library holds security tools for protecting Java API calls.

License: MIT ✅ | Open source ✅ | More facts

korbit-ai · 2024-04-16T06:03:36Z

You’ve installed Korbit to your Github repository but you haven’t created a Korbit account yet! To create your Korbit account and get your PR scans, please visit https://mentor.korbit.ai/dashboard

code-genius-code-coverage · 2024-04-16T06:03:36Z

The files' contents are under analysis for test generation.

senior-dev-bot · 2024-04-16T06:03:37Z

Hi there! 👋 Thanks for opening a PR. 🎉 To get the most out of Senior Dev, please sign up in our Web App, connect your GitHub account, and add/join your organization Sowhat999. After that, you will receive code reviews beginning on your next opened PR. 🚀

git-greetings · 2024-04-16T06:03:37Z

Thanks @pixeebot[bot] for opening this PR!

For COLLABORATOR only :

To add labels, comment on the issue
/label add label1,label2,label3
To remove labels, comment on the issue
/label remove label1,label2,label3

gitginie

@pixeebot[bot]
Thank you for your contribution to this repository! We appreciate your effort in opening pull request.
Happy coding!

pr-code-reviewer · 2024-04-16T06:03:38Z

👋 Hi there!

Everything looks good!

_{^{Automatically generated with the help of gpt-3.5-turbo.

Feedback? Please don't hesitate to drop me an email at webber@takken.io.}}

code-companion-ai · 2024-04-16T06:03:38Z

Processing PR updates...

coderabbitai · 2024-04-16T06:03:38Z

Important

Auto Review Skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Thank you for using CodeRabbit. We offer it for free to the OSS community and would appreciate your support in helping us grow. If you find it useful, would you consider giving us a shout-out on your favorite social media?

Share

Tips

Chat

There are 3 ways to chat with CodeRabbit:

Review comments: Directly reply to a review comment made by CodeRabbit. Example:
- I pushed a fix in commit <commit_id>.
- Generate unit testing code for this file.
- Open a follow-up GitHub issue for this discussion.
Files and specific lines of code (under the "Files changed" tab): Tag @coderabbitai in a new review comment at the desired location with your query. Examples:
- @coderabbitai generate unit testing code for this file.
- @coderabbitai modularize this function.
PR comments: Tag @coderabbitai in a new PR comment to ask questions about the PR branch. For the best results, please provide a very specific query, as very limited context is provided in this mode. Examples:
- @coderabbitai generate interesting stats about this repository and render them as a table.
- @coderabbitai show all the console.log statements in this repository.
- @coderabbitai read src/utils.ts and generate unit testing code.
- @coderabbitai read the files in the src/scheduler package and generate a class diagram using mermaid and a README in the markdown format.

Note: Be mindful of the bot's finite context window. It's strongly recommended to break down tasks such as reading entire modules into smaller chunks. For a focused discussion, use review comments to chat about specific files and their changes, instead of using the PR comments.

CodeRabbit Commands (invoked as PR comments)

@coderabbitai pause to pause the reviews on a PR.
@coderabbitai resume to resume the paused reviews.
@coderabbitai review to trigger a review. This is useful when automatic reviews are disabled for the repository.
@coderabbitai resolve resolve all the CodeRabbit review comments.
@coderabbitai help to get help.

Additionally, you can add @coderabbitai ignore anywhere in the PR description to prevent this PR from being reviewed.

CodeRabbit Configration File (`.coderabbit.yaml`)

You can programmatically configure CodeRabbit by adding a .coderabbit.yaml file to the root of your repository.
Please see the configuration documentation for more information.
If your editor has YAML language server enabled, you can add the path at the top of this file to enable auto-completion and validation: # yaml-language-server: $schema=https://coderabbit.ai/integrations/schema.v2.json

Documentation and Community

Visit our Documentation for detailed information on how to use CodeRabbit.
Join our Discord Community to get help, request features, and share feedback.
Follow us on X/Twitter for updates and announcements.

instapr · 2024-04-16T06:03:38Z

Feedback:

Implemented protection against deserialization attacks by introducing the java-security-toolkit dependency.
Utilized ObjectInputFilters to prevent exploitation through deserialization in CountrySchemaSql.java and RainbowFishSerializer.java.

Overall, great work on addressing this critical security vulnerability! Well done 👍🏼.

git-greetings · 2024-04-16T06:03:40Z

PR Details of @pixeebot[bot] in java-design-patterns :

OPEN	CLOSED	TOTAL
2	1	3

codara-ai-code-review · 2024-04-16T06:03:41Z

Potential issues, bugs, and flaws that can introduce unwanted behavior:

/pom.xml:
- The <versions.java-security-toolkit> property is added but not used anywhere in the file. This can lead to confusion or indicate unused configuration.
/tolerant-reader/pom.xml, /serialized-entity/pom.xml, /serialized-entity/pom.xml:
- The addition of <groupId>io.github.pixee</groupId> and <artifactId>java-security-toolkit</artifactId> dependencies without specifying a version may cause dependency resolution issues if the version is not locked down appropriately.

Code suggestions and improvements for better exception handling, logic, standardization, and consistency:

/serialized-entity/src/main/java/com/iluwatar/serializedentity/CountrySchemaSql.java:
- It is important to handle or log any exceptions that may be thrown by ObjectInputFilters.enableObjectFilterIfUnprotected(ois); to prevent unexpected crashes or silent failures.
/tolerant-reader/src/main/java/com/iluwatar/tolerantreader/RainbowFishSerializer.java:
- Similar to the previous file, handling or logging exceptions that may be thrown by ObjectInputFilters.enableObjectFilterIfUnprotected(objIn); is crucial for robust error management.

codereviewbot-ai · 2024-04-16T06:04:26Z

serialized-entity/src/main/java/com/iluwatar/serializedentity/CountrySchemaSql.java

          ByteArrayInputStream baos = new ByteArrayInputStream(countryBlob.getBytes(1, (int) countryBlob.length()));
          ObjectInputStream ois = new ObjectInputStream(baos);
+          ObjectInputFilters.enableObjectFilterIfUnprotected(ois);
          country = (Country) ois.readObject();
          LOGGER.info("Country: " + country);


The code is vulnerable to Java deserialization attacks because it deserializes objects without validating the source or the content of the serialized data. This can lead to various attacks, including arbitrary code execution if the application is processing data from untrusted sources.

To mitigate this risk, it's recommended to implement a more secure form of serialization or use a library that provides safe deserialization features. Additionally, consider using validation mechanisms such as custom ObjectInputFilters to check the classes being deserialized or the size of the object graph being created.

codereviewbot-ai · 2024-04-16T06:04:26Z

tolerant-reader/src/main/java/com/iluwatar/tolerantreader/RainbowFishSerializer.java

    try (var fileIn = new FileInputStream(filename);
         var objIn = new ObjectInputStream(fileIn)) {
+      ObjectInputFilters.enableObjectFilterIfUnprotected(objIn);
      map = (Map<String, String>) objIn.readObject();


The use of ObjectInputStream without a proper validation mechanism for deserialized objects can lead to security vulnerabilities, such as arbitrary code execution if the content of the file is malicious. While ObjectInputFilters.enableObjectFilterIfUnprotected(objIn); is an attempt to mitigate this, it's crucial to ensure that the filter is correctly configured to only allow safe classes to be deserialized. Recommended solution is to explicitly check or restrict the classes that can be deserialized by configuring the ObjectInputFilter to only allow known safe classes.

codereviewbot-ai · 2024-04-16T06:04:26Z

tolerant-reader/src/main/java/com/iluwatar/tolerantreader/RainbowFishSerializer.java

    try (var fileIn = new FileInputStream(filename);
         var objIn = new ObjectInputStream(fileIn)) {
+      ObjectInputFilters.enableObjectFilterIfUnprotected(objIn);
      map = (Map<String, String>) objIn.readObject();


Casting the result of objIn.readObject() directly to (Map<String, String>) without checking can lead to a ClassCastException if the object read is not actually a Map<String, String>. This can be a problem especially when dealing with serialized objects from untrusted sources or when the serialized form might change. It's recommended to perform a type check before casting, or use a safer deserialization method that can handle type mismatches gracefully.

codesyncapp · 2024-04-16T06:06:57Z

Check out the playback for this Pull Request here.

pixeebot · 2024-04-24T03:02:54Z

I'm confident in this change, but I'm not a maintainer of this project. Do you see any reason not to merge it?

If this change was not helpful, or you have suggestions for improvements, please let me know!

pixeebot · 2024-04-25T03:02:49Z

Just a friendly ping to remind you about this change. If there are concerns about it, we'd love to hear about them!

pixeebot · 2024-05-01T03:02:59Z

This change may not be a priority right now, so I'll close it. If there was something I could have done better, please let me know!

You can also customize me to make sure I'm working with you in the way you want.

gitginie

@pixeebot[bot]
Thank you for your contribution to this repository! We appreciate your effort in closing pull request.
Happy coding!

Introduced protections against deserialization attacks

867fb55

pixeebot bot commented Apr 16, 2024

View reviewed changes

gitginie bot reviewed Apr 16, 2024

View reviewed changes

gstraccini bot assigned D0LLi Apr 16, 2024

gstraccini bot approved these changes Apr 16, 2024

View reviewed changes

gstraccini bot requested a review from D0LLi April 16, 2024 06:04

codereviewbot-ai bot reviewed Apr 16, 2024

View reviewed changes

codeant-ai bot added @enhancement New feature or request bug_fix labels Apr 16, 2024

pixeebot bot closed this May 1, 2024

gitginie bot reviewed May 1, 2024

View reviewed changes

octopaji bot mentioned this pull request Oct 31, 2024

Introduced protections against deserialization attacks #16

Closed

Introduced protections against deserialization attacks #3

Introduced protections against deserialization attacks #3

Uh oh!

Conversation

pixeebot bot commented Apr 16, 2024 • edited by codeant-ai bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

User description

Description

Changes walkthrough

Checking Your Pull Request

Talking to CodeAnt AI

Check Your Repository Health

Uh oh!

pixeebot bot Apr 16, 2024

Choose a reason for hiding this comment

Uh oh!

pixeebot bot Apr 16, 2024

Choose a reason for hiding this comment

Uh oh!

pixeebot bot Apr 16, 2024

Choose a reason for hiding this comment

Uh oh!

pixeebot bot Apr 16, 2024

Choose a reason for hiding this comment

Uh oh!

korbit-ai bot commented Apr 16, 2024

Uh oh!

code-genius-code-coverage bot commented Apr 16, 2024

Uh oh!

senior-dev-bot bot commented Apr 16, 2024

Uh oh!

git-greetings bot commented Apr 16, 2024

Uh oh!

gitginie bot left a comment

Choose a reason for hiding this comment

Uh oh!

pr-code-reviewer bot commented Apr 16, 2024 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

👋 Hi there!

Uh oh!

code-companion-ai bot commented Apr 16, 2024

Uh oh!

coderabbitai bot commented Apr 16, 2024

Auto Review Skipped

Chat

CodeRabbit Commands (invoked as PR comments)

CodeRabbit Configration File (.coderabbit.yaml)

Documentation and Community

Uh oh!

instapr bot commented Apr 16, 2024

Feedback:

Uh oh!

git-greetings bot commented Apr 16, 2024

Uh oh!

codara-ai-code-review bot commented Apr 16, 2024

Potential issues, bugs, and flaws that can introduce unwanted behavior:

Code suggestions and improvements for better exception handling, logic, standardization, and consistency:

Uh oh!

codereviewbot-ai bot Apr 16, 2024

Choose a reason for hiding this comment

Uh oh!

codereviewbot-ai bot Apr 16, 2024

Choose a reason for hiding this comment

Uh oh!

codereviewbot-ai bot Apr 16, 2024

Choose a reason for hiding this comment

Uh oh!

codesyncapp bot commented Apr 16, 2024

Uh oh!

pixeebot bot commented Apr 24, 2024

Uh oh!

pixeebot bot commented Apr 25, 2024

Uh oh!

pixeebot bot commented May 1, 2024

Uh oh!

gitginie bot left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

pixeebot bot commented Apr 16, 2024 •

edited by codeant-ai bot

Loading

pr-code-reviewer bot commented Apr 16, 2024 •

edited

Loading

CodeRabbit Configration File (`.coderabbit.yaml`)