RHBRMS-2784 - XStream: DoS when unmarshalling void type (#928) (#949)

(cherry picked from commit c8814ae)
kiegroup · Aug 21, 2017 · 5b47648 · 5b47648
1 parent a605c26
commit 5b47648
Show file tree

Hide file tree

Showing 3 changed files with 8 additions and 2 deletions.
diff --git a/jbpm-audit/src/main/java/org/jbpm/process/audit/jms/AsyncAuditLogProducer.java b/jbpm-audit/src/main/java/org/jbpm/process/audit/jms/AsyncAuditLogProducer.java
@@ -171,6 +171,8 @@ protected void sendMessage(Object messageContent, Integer eventType) {
             queueSession = queueConnection.createSession(transacted, Session.AUTO_ACKNOWLEDGE);
 
             XStream xstream = new XStream();
+            String[] voidDeny = {"void.class", "Void.class"};
+            xstream.denyTypes(voidDeny);
             String eventXml = xstream.toXML(messageContent);
             TextMessage message = queueSession.createTextMessage(eventXml);
             message.setIntProperty("EventType", eventType);

diff --git a/jbpm-audit/src/main/java/org/jbpm/process/audit/jms/AsyncAuditLogReceiver.java b/jbpm-audit/src/main/java/org/jbpm/process/audit/jms/AsyncAuditLogReceiver.java
@@ -68,8 +68,10 @@ public void onMessage(Message message) {
             try {
                 String messageContent = textMessage.getText();
                 Integer eventType = textMessage.getIntProperty("EventType");
-                XStream xstram = new XStream();
-                Object event = xstram.fromXML(messageContent);
+                XStream xstream = new XStream();
+                String[] voidDeny = {"void.class", "Void.class"};
+                xstream.denyTypes(voidDeny);
+                Object event = xstream.fromXML(messageContent);
 
                 switch (eventType) {
                 case AbstractAuditLogger.AFTER_NODE_ENTER_EVENT_TYPE:

diff --git a/...ces/jbpm-kie-services/src/main/java/org/jbpm/kie/services/impl/store/DeploymentStore.java b/...ces/jbpm-kie-services/src/main/java/org/jbpm/kie/services/impl/store/DeploymentStore.java
@@ -52,6 +52,8 @@ public class DeploymentStore {
 	private TransactionalCommandService commandService;
 
 	public DeploymentStore() {
+		String[] voidDeny = {"void.class", "Void.class"};
+		xstream.denyTypes(voidDeny);
 	    this.xstream.registerConverter(new TransientObjectConverter());
 	}