|
 |
e58614 |
From 9d4e3462f17d135b5c928e2419a17bd444c3f2b4 Mon Sep 17 00:00:00 2001
|
|
|
e58614 |
From: Michael Simacek <msimacek@redhat.com>
|
|
|
e58614 |
Date: Mon, 19 Mar 2018 16:01:57 +0100
|
|
|
e58614 |
Subject: [PATCH] Disallow EventData deserialization by default
|
|
|
e58614 |
|
|
|
e58614 |
---
|
|
|
e58614 |
.../src/main/java/org/slf4j/ext/EventData.java | 23 +++++++++++++++-------
|
|
|
e58614 |
1 file changed, 16 insertions(+), 7 deletions(-)
|
|
|
e58614 |
|
|
|
e58614 |
diff --git a/slf4j-ext/src/main/java/org/slf4j/ext/EventData.java b/slf4j-ext/src/main/java/org/slf4j/ext/EventData.java
|
|
|
e58614 |
index 4478e52..535c5c0 100644
|
|
|
e58614 |
--- a/slf4j-ext/src/main/java/org/slf4j/ext/EventData.java
|
|
|
e58614 |
+++ b/slf4j-ext/src/main/java/org/slf4j/ext/EventData.java
|
|
|
e58614 |
@@ -76,13 +76,22 @@ public class EventData implements Serializable {
|
|
|
e58614 |
*/
|
|
|
e58614 |
@SuppressWarnings("unchecked")
|
|
|
e58614 |
public EventData(String xml) {
|
|
|
e58614 |
- ByteArrayInputStream bais = new ByteArrayInputStream(xml.getBytes());
|
|
|
e58614 |
- try {
|
|
|
e58614 |
- XMLDecoder decoder = new XMLDecoder(bais);
|
|
|
e58614 |
- this.eventData = (Map<String, Object>) decoder.readObject();
|
|
|
e58614 |
- } catch (Exception e) {
|
|
|
e58614 |
- throw new EventException("Error decoding " + xml, e);
|
|
|
e58614 |
- }
|
|
|
e58614 |
+ if ("1".equals(System.getProperty("org.slf4j.ext.allowInsecureDeserialization"))) {
|
|
|
e58614 |
+ ByteArrayInputStream bais = new ByteArrayInputStream(xml.getBytes());
|
|
|
e58614 |
+ try {
|
|
|
e58614 |
+ XMLDecoder decoder = new XMLDecoder(bais);
|
|
|
e58614 |
+ this.eventData = (Map<String, Object>) decoder.readObject();
|
|
|
e58614 |
+ } catch (Exception e) {
|
|
|
e58614 |
+ throw new EventException("Error decoding " + xml, e);
|
|
|
e58614 |
+ }
|
|
|
e58614 |
+ } else {
|
|
|
e58614 |
+ throw new UnsupportedOperationException(
|
|
|
e58614 |
+ "Constructing EventData from XML is vulnerable to remote " +
|
|
|
e58614 |
+ "excution and is not allowed by default. If you're " +
|
|
|
e58614 |
+ "completely sure the source data is trusted, you can enable " +
|
|
|
e58614 |
+ "it by setting org.slf4j.ext.allowInsecureDeserialization " +
|
|
|
e58614 |
+ "JVM property to 1");
|
|
|
e58614 |
+ }
|
|
|
e58614 |
}
|
|
|
e58614 |
|
|
|
e58614 |
/**
|
|
|
e58614 |
--
|
|
|
e58614 |
2.14.3
|
|
|
e58614 |
|