-
Notifications
You must be signed in to change notification settings - Fork 145
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
added a new read config flag of anchor to enable/disable following an… (
#164) * added a new read config flag of anchor to enable/disable following anchors ( enabled by default ). Also added a new SafeYamlConfig class that disables Class Tags and Anchors to remediate CVE-2023-24620 CVE-2023-24621 * setAnchor() and setClassTag() now throws an IllegalArgumentException if an attempt is made to set them to true.
- Loading branch information
Showing
4 changed files
with
156 additions
and
9 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,50 @@ | ||
| package com.esotericsoftware.yamlbeans; | ||
|
|
||
|
|
||
| /** | ||
| * SafeYamlConfig extends YamlConfig and hard codes the read anchor and read class tag flags to false. | ||
| * When these flags are enabled, it is possible to perform a deserialization attack if the Yaml being parsed is from an | ||
| * untrusted source. | ||
| * Using SafeYamlConfig is the equivalent of using YamlConfig after setting | ||
| * yamlConfig.readConfig.setAnchors(false); | ||
| * yamlConfig.readConfig.setClassTags(false); | ||
| * | ||
| * It should be noted by setting these two values neither anchors or specifying class names are supported. | ||
| * It is still possible to deserialize back to a specific object, but you need to specify the Class type in the code. | ||
| * e.g | ||
| * SafeYamlConfig yamlConfig = new SafeYamlConfig(); | ||
| * YamlReader reader = new YamlReader(yamlData.toString(),yamlConfig); | ||
| * Data data = reader.read(Data.class); | ||
| * | ||
| */ | ||
| public class SafeYamlConfig extends YamlConfig { | ||
|
|
||
|
|
||
| public SafeYamlConfig () { | ||
| super(); | ||
| super.readConfig = new SafeReadConfig(); | ||
| } | ||
|
|
||
| static public class SafeReadConfig extends ReadConfig { | ||
|
|
||
| public SafeReadConfig(){ | ||
| super.anchors = false; | ||
| super.classTags = false; | ||
| } | ||
|
|
||
| @Override | ||
| public void setClassTags(boolean classTags) { | ||
| if(classTags) { | ||
| throw new IllegalArgumentException("Class Tags cannot be enabled in SafeYamlConfig."); | ||
| } | ||
| } | ||
|
|
||
| @Override | ||
| public void setAnchors(boolean anchors) { | ||
| if(anchors) { | ||
| throw new IllegalArgumentException("Anchors cannot be enabled in SafeYamlConfig."); | ||
| } | ||
| } | ||
| } | ||
|
|
||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
79 changes: 79 additions & 0 deletions
79
test/com/esotericsoftware/yamlbeans/SafeYamlConfigTest.java
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,79 @@ | ||
| package com.esotericsoftware.yamlbeans; | ||
|
|
||
| import org.junit.Test; | ||
|
|
||
| import java.util.HashMap; | ||
| import java.util.List; | ||
| import java.util.Map; | ||
|
|
||
| import static junit.framework.Assert.assertEquals; | ||
| import static junit.framework.Assert.assertNull; | ||
| import static junit.framework.Assert.assertTrue; | ||
|
|
||
| public class SafeYamlConfigTest { | ||
|
|
||
|
|
||
| private static final String TESTOBJECT_TAG = "!com.esotericsoftware.yamlbeans.SafeYamlConfigTest$TestObject"; | ||
| private static final String LINE_SEPARATOR = System.getProperty("line.separator"); | ||
|
|
||
|
|
||
| @Test | ||
| public void testDeserializationOfClassTag() throws YamlException { | ||
| SafeYamlConfig yamlConfig = new SafeYamlConfig(); | ||
| StringBuilder yamlData = new StringBuilder(); | ||
| yamlData.append(TESTOBJECT_TAG).append(LINE_SEPARATOR) | ||
| .append("a: test").append(LINE_SEPARATOR); | ||
| YamlReader reader = new YamlReader(yamlData.toString(),yamlConfig); | ||
| Object data = reader.read(); | ||
| assertTrue(data instanceof HashMap); | ||
| Map dataMap = (Map) data; | ||
| assertTrue(dataMap.containsKey("a")); | ||
| assertEquals("test",dataMap.get("a")); | ||
| } | ||
|
|
||
|
|
||
|
|
||
| @Test | ||
| public void testIgnoreAnchor() throws YamlException { | ||
| SafeYamlConfig yamlConfig = new SafeYamlConfig(); | ||
| StringBuilder yamlData = new StringBuilder(); | ||
| yamlData.append("oldest friend:").append(LINE_SEPARATOR) | ||
| .append(" &1 !contact").append(LINE_SEPARATOR) | ||
| .append(" name: Bob").append(LINE_SEPARATOR) | ||
| .append(" age: 29").append(LINE_SEPARATOR) | ||
| .append("best friend: *1").append(LINE_SEPARATOR); | ||
| YamlReader reader = new YamlReader(yamlData.toString(),yamlConfig); | ||
| Object data = reader.read(); | ||
| assertTrue(data instanceof HashMap); | ||
| Map dataMap = (Map) data; | ||
| assertTrue(dataMap.containsKey("oldest friend")); | ||
| Map old = (Map) dataMap.get("oldest friend"); | ||
| assertTrue(old.containsKey("name")); | ||
| assertEquals("Bob",old.get("name")); | ||
| assertNull(dataMap.get("best friend")); | ||
| } | ||
|
|
||
|
|
||
| static class TestObject { | ||
| private String a; | ||
| public int age; | ||
| public String name; | ||
| public Object object; | ||
| public List<Object> objects; | ||
|
|
||
| private TestObject() { | ||
| } | ||
|
|
||
| public TestObject(String a) { | ||
| this.a = a; | ||
| } | ||
|
|
||
| public String getA() { | ||
| return a; | ||
| } | ||
|
|
||
| public void setA(String a) { | ||
| this.a = a; | ||
| } | ||
| } | ||
| } |