mirror of
https://github.com/github/codeql.git
synced 2026-05-04 13:15:21 +02:00
Update UnsafeDeserialization.qhelp
Move the table under <recommendation>, minor fixes.
This commit is contained in:
Tony Torralba
committed by
Jonathan Leitschuh
Jonathan Leitschuh
parent
3fa11c21c3
commit
b7364f5428
@@ -28,11 +28,64 @@ for example JSON or XML. However, these formats should not be deserialized
|
||||
into complex objects because this provides further opportunities for attack.
|
||||
For example, XML-based deserialization attacks
|
||||
are possible through libraries such as XStream and XmlDecoder.
|
||||
|
||||
</p>
|
||||
<p>
|
||||
Alternatively, a tightly controlled whitelist can limit the vulnerability of code, but be aware
|
||||
of the existence of so-called Bypass Gadgets, which can circumvent such
|
||||
protection measures.
|
||||
</p>
|
||||
<p>
|
||||
Fixes by framework:
|
||||
</p>
|
||||
<table>
|
||||
<tbody>
|
||||
<tr>
|
||||
<th>Project</th>
|
||||
<th>Maven Coordinates</th>
|
||||
<th>Secure by Default</th>
|
||||
<th>Fix</th>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>XMLDecoder</td>
|
||||
<td>Java Standard Library</td>
|
||||
<td>No</td>
|
||||
<td>Don't use XMLDecoder with untrusted user input. It is impossible to secure.</td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>ObjectInputStream</td>
|
||||
<td>Java Standard Library</td>
|
||||
<td>No</td>
|
||||
<td>Leverage a validating input stream like <code>org.apache.commons.io.serialization.ValidatingObjectInputStream</code>.</td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>FastJson</td>
|
||||
<td>com.alibaba:fastjson</td>
|
||||
<td>Partially</td>
|
||||
<td>Call <code>com.alibaba.fastjson.parser.ParserConfig#setSafeMode</code> with the argument <code>true</code>.</td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>SnakeYAML</td>
|
||||
<td>org.yaml:snakeyaml</td>
|
||||
<td><a href="https://bitbucket.org/snakeyaml/snakeyaml/wiki/CVE%20&%20NIST.md">No</a> (<a href="https://bitbucket.org/snakeyaml/snakeyaml/issues/561/cve-2022-1471-vulnerability-in">maintainer response</a>)</td>
|
||||
<td>Instantiate the <code>org.yaml.snakeyaml.Yaml</code> instance explicitly with an instance of <code>org.yaml.snakeyaml.constructor.SafeConstructor</code> as an argument.</td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>FasterXML jackson-databind</td>
|
||||
<td>com.fasterxml.jackson.core:jackson-databind</td>
|
||||
<td>Yes</td>
|
||||
<td>
|
||||
Don't call <code>com.fasterxml.jackson.databind.ObjectMapper#enableDefaultTyping</code> and don't annotate any object fields with <code>com.fasterxml.jackson.annotation.JsonTypeInfo</code> passing either the <code>CLASS</code> or <code>MINIMAL_CLASS</code> values to the annotation.
|
||||
Read <a href="https://cowtowncoder.medium.com/jackson-2-10-safe-default-typing-2d018f0ce2ba">this guide</a>.
|
||||
</td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Kryo</td>
|
||||
<td>com.esotericsoftware:kryo and com.esotericsoftware:kryo5</td>
|
||||
<td>com.esotericsoftware:kryo >= 5.0.0 and com.esotericsoftware:kryo5 Yes</td>
|
||||
<td>Don't call <code>com.esotericsoftware.kryo(5).Kryo#setRegistrationRequired</code> with the argument <code>false</code>.</td>
|
||||
</tr>
|
||||
</tbody>
|
||||
</table>
|
||||
</recommendation>
|
||||
|
||||
<example>
|
||||
@@ -51,59 +104,6 @@ from the input stream removes the vulnerability.
|
||||
|
||||
</example>
|
||||
|
||||
<p>
|
||||
|
||||
Fixes by framework
|
||||
<table>
|
||||
<tbody>
|
||||
<tr>
|
||||
<th>Project</th>
|
||||
<th>Maven Cordinates</th>
|
||||
<th>Secure by Default</th>
|
||||
<th>Fix</th>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>XMLDecoder</td>
|
||||
<td>Java Standard Library</td>
|
||||
<td>No</td>
|
||||
<td>Don't use XMLDecoder with untrusted user input. It is impossible to secure.</td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>ObjectInputStream</td>
|
||||
<td>Java Standard Library</td>
|
||||
<td>No</td>
|
||||
<td>Leverage a validating input stream like <code>org.apache.commons.io.serialization.ValidatingObjectInputStream</code></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>FastJson</td>
|
||||
<td>com.alibaba:fastjson</td>
|
||||
<td>Partially</td>
|
||||
<td>Call <code>com.alibaba.fastjson.parser.ParserConfig#setSafeMode</code> with the argument <code>true</code></td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>SnakeYAML</td>
|
||||
<td>org.yaml:snakeyaml</td>
|
||||
<td><a href="https://bitbucket.org/snakeyaml/snakeyaml/wiki/CVE%20&%20NIST.md">No</a>. <a href="https://bitbucket.org/snakeyaml/snakeyaml/issues/561/cve-2022-1471-vulnerability-in">Maintainer response</a>.</td>
|
||||
<td>Instantiate the <code>org.yaml.snakeyaml.Yaml</code> instance explicitly with an instance of <code>org.yaml.snakeyaml.constructor.SafeConstructor</code> as an argument.</td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>FasterXML jackson-databind</td>
|
||||
<td>com.fasterxml.jackson.core:jackson-databind</td>
|
||||
<td>Yes</td>
|
||||
<td>
|
||||
Don't call <code>com.fasterxml.jackson.databind.ObjectMapper#enableDefaultTyping</code> and don't annotate any object fields with <code>com.fasterxml.jackson.annotation.JsonTypeInfo</code> passing either the <code>CLASS</code> or <code>MINIMAL_CLASS</code> values to the annotation.
|
||||
Read <a href="https://cowtowncoder.medium.com/jackson-2-10-safe-default-typing-2d018f0ce2ba">this guide</a>.
|
||||
</td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td>Kryo</td>
|
||||
<td>com.esotericsoftware:kryo and com.esotericsoftware:kryo5</td>
|
||||
<td>com.esotericsoftware:kryo versions including & after 5.0.0 Yes; com.esotericsoftware:kryo5 Yes</td>
|
||||
<td>Don't call <code>com.esotericsoftware.kryo(5).Kryo#setRegistrationRequired</code> with the argument <code>false</code>.</td>
|
||||
</tr>
|
||||
</tbody>
|
||||
</table>
|
||||
|
||||
<references>
|
||||
|
||||
<li>
|
||||
|
||||
Reference in New Issue
Block a user