Pebble Security Issue

[securityMB]

I have found a security issue in Pebble similar to #435. Do you provide a way to report it or privately (e.g. via email) or are you okay with releasing details in the public issue?

[ebussieres]

Please report it here

[securityMB]

Thank you for quick answer.

So Pebble blocks access to getClass() but there might be other ways to get direct access to instances of java.lang.Class. Some Java classes have TYPE static field whose value is instance of java.lang.Class. An example being: java.lang.Integer.

So instead of using

{{ ''.getClass().forName('java.lang.Runtime')... }}

the attacker can use

{{ (1).TYPE.forName('java.lang.Runtime')... }}

I believe that at least on of the following can be done to limit the risk:

• Check whether any method or field returns an instance of java.lang.Class and block it if it does,
• Block certain methods that are commonly used to execute arbitrary Java code. FreeMarker, for instance, has a file unsafeMethods.properties with several dozen methods that are considered unsafe for templating.

[ebussieres]

I like the freeMarker approch ... could you make a PR for this ?

[securityMB]

@ebussieres I'd love to but I've never actually programmed in Java so I don't really feel confident about doing it right.

[ebussieres]

Gonna be fixed in next release