Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
Browse files
Browse the repository at this point in the history
…18180) * Restrict classes allowed for cluster config and event types (#18165) Add a new safe_classes configuration option to restrict the classes allowed to be used as cluster config and event types. The configuration option allows to specify a comma-separated set of prefixes matched against the fully qualified class name. For now, the default value for the configuration is org.graylog.,org.graylog2., which will allow all classes that Graylog maintains. This should work out of the box for almost all setups. Changing the default value might only be necessary if external plugins require cluster config or event types outside the "org.graylog." or "org.graylog2." namespaces. If that is the case, the configuration setting can be adjusted to cover this use case, e.b. by setting it to safe_classes = org.graylog.,org.graylog2.,custom.plugin.namespace. if said classes are located within the custom.plugin.namespace package. Refs: GHSA-p6gg-5hf4-4rgj (cherry picked from commit 8132032) * Use javax.inject.Inject instead of jakarta.inject.Inject * Add "jakarta.inject.**" to forbidden APIs This will help us with issue for backported code that's already using jakarta.inject. * Use javax.ws.rs instead of jakarta.ws.rs --------- Co-authored-by: Othello Maurer <othello@graylog.com>
- Loading branch information
Showing
17 changed files
with
430 additions
and
30 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,4 @@ | ||
| type = "security" | ||
| message = "Restrict classes allowed for cluster config and event types. [GHSA-p6gg-5hf4-4rgj](https://github.com/Graylog2/graylog2-server/security/advisories/GHSA-p6gg-5hf4-4rgj)" | ||
|
|
||
| pulls = ["18165"] |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
61 changes: 61 additions & 0 deletions
61
graylog2-server/src/main/java/org/graylog2/security/RestrictedChainingClassLoader.java
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,61 @@ | ||
| /* | ||
| * Copyright (C) 2020 Graylog, Inc. | ||
| * | ||
| * This program is free software: you can redistribute it and/or modify | ||
| * it under the terms of the Server Side Public License, version 1, | ||
| * as published by MongoDB, Inc. | ||
| * | ||
| * This program is distributed in the hope that it will be useful, | ||
| * but WITHOUT ANY WARRANTY; without even the implied warranty of | ||
| * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the | ||
| * Server Side Public License for more details. | ||
| * | ||
| * You should have received a copy of the Server Side Public License | ||
| * along with this program. If not, see | ||
| * <http://www.mongodb.com/licensing/server-side-public-license>. | ||
| */ | ||
| package org.graylog2.security; | ||
|
|
||
| import org.graylog2.Configuration; | ||
| import org.graylog2.shared.plugins.ChainingClassLoader; | ||
|
|
||
| import javax.inject.Inject; | ||
|
|
||
| import static org.graylog2.shared.utilities.StringUtils.f; | ||
|
|
||
| /** | ||
| * A wrapper around the chaining class loader intended only for loading classes safely by considering an allow-list of | ||
| * class name prefixes. | ||
| */ | ||
| public class RestrictedChainingClassLoader { | ||
| private final ChainingClassLoader delegate; | ||
| private final SafeClasses safeClasses; | ||
|
|
||
| @Inject | ||
| public RestrictedChainingClassLoader(ChainingClassLoader delegate, SafeClasses safeClasses) { | ||
| this.delegate = delegate; | ||
| this.safeClasses = safeClasses; | ||
| } | ||
|
|
||
| /** | ||
| * Load the class only if the name passes the check of {@link SafeClasses#isSafeToLoad(String)}. If the class name | ||
| * passes the check, the call is delegated to {@link ChainingClassLoader#loadClass(String)}. If it doesn't pass the | ||
| * check, an {@link UnsafeClassLoadingAttemptException} is thrown. | ||
| * | ||
| * @return class as returned by the delegated call to {@link ChainingClassLoader#loadClass(String)} | ||
| * @throws ClassNotFoundException if the class was not found | ||
| * @throws UnsafeClassLoadingAttemptException if the class name didn't pass the safety check of | ||
| * {@link SafeClasses#isSafeToLoad(String)} | ||
| */ | ||
| public Class<?> loadClassSafely(String name) throws ClassNotFoundException, UnsafeClassLoadingAttemptException { | ||
| if (safeClasses.isSafeToLoad(name)) { | ||
| return delegate.loadClass(name); | ||
| } else { | ||
| throw new UnsafeClassLoadingAttemptException( | ||
| f("Prevented loading of unsafe class \"%s\". Consider adjusting the configuration setting " + | ||
| "\"%s\", if you think that this is a mistake.", name, Configuration.SAFE_CLASSES) | ||
| ); | ||
| } | ||
| } | ||
|
|
||
| } |
52 changes: 52 additions & 0 deletions
52
graylog2-server/src/main/java/org/graylog2/security/SafeClasses.java
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,52 @@ | ||
| /* | ||
| * Copyright (C) 2020 Graylog, Inc. | ||
| * | ||
| * This program is free software: you can redistribute it and/or modify | ||
| * it under the terms of the Server Side Public License, version 1, | ||
| * as published by MongoDB, Inc. | ||
| * | ||
| * This program is distributed in the hope that it will be useful, | ||
| * but WITHOUT ANY WARRANTY; without even the implied warranty of | ||
| * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the | ||
| * Server Side Public License for more details. | ||
| * | ||
| * You should have received a copy of the Server Side Public License | ||
| * along with this program. If not, see | ||
| * <http://www.mongodb.com/licensing/server-side-public-license>. | ||
| */ | ||
| package org.graylog2.security; | ||
|
|
||
| import org.graylog2.Configuration; | ||
|
|
||
| import javax.annotation.Nonnull; | ||
| import javax.inject.Inject; | ||
| import javax.inject.Named; | ||
| import javax.inject.Singleton; | ||
| import java.util.Objects; | ||
| import java.util.Set; | ||
|
|
||
| /** | ||
| * Adds a safety net for class loading. | ||
| */ | ||
| @Singleton | ||
| public class SafeClasses { | ||
| private final Set<String> prefixes; | ||
|
|
||
| public static SafeClasses allGraylogInternal() { | ||
| return new SafeClasses(Set.of("org.graylog.", "org.graylog2.")); | ||
| } | ||
|
|
||
| @Inject | ||
| public SafeClasses(@Named(Configuration.SAFE_CLASSES) @Nonnull Set<String> prefixes) { | ||
| this.prefixes = Objects.requireNonNull(prefixes); | ||
| } | ||
|
|
||
| /** | ||
| * Check if the class name is considered safe for loading by names from a potentially user-provided input. | ||
| * Classes are considered safe if their fully qualified class name starts with any of the prefixes configured in | ||
| * {@link Configuration#getSafeClasses()}. | ||
| */ | ||
| public boolean isSafeToLoad(String className) { | ||
| return prefixes.stream().anyMatch(className::startsWith); | ||
| } | ||
| } |
Oops, something went wrong.