From 1594395df534d60133d98884c9d9f5eb92d0652e Mon Sep 17 00:00:00 2001 From: Mat Booth Date: Wed, 1 Apr 2020 10:21:03 +0100 Subject: [PATCH 6/6] Fix for CVE-2019-17570 Deserialization of server-side exception from faultCause in XMLRPC error response --- .../xmlrpc/parser/XmlRpcResponseParser.java | 28 ++++++++++--------- 1 file changed, 15 insertions(+), 13 deletions(-) diff --git a/common/src/main/java/org/apache/xmlrpc/parser/XmlRpcResponseParser.java b/common/src/main/java/org/apache/xmlrpc/parser/XmlRpcResponseParser.java index 087572b..f1b2427 100644 --- a/common/src/main/java/org/apache/xmlrpc/parser/XmlRpcResponseParser.java +++ b/common/src/main/java/org/apache/xmlrpc/parser/XmlRpcResponseParser.java @@ -69,19 +69,21 @@ public class XmlRpcResponseParser extends RecursiveTypeParserImpl { getDocumentLocator()); } errorMessage = (String) map.get("faultString"); - Object exception = map.get("faultCause"); - if (exception != null) { - try { - byte[] bytes = (byte[]) exception; - ByteArrayInputStream bais = new ByteArrayInputStream(bytes); - ObjectInputStream ois = new ObjectInputStream(bais); - errorCause = (Throwable) ois.readObject(); - ois.close(); - bais.close(); - } catch (Throwable t) { - // Ignore me - } - } + if (((XmlRpcStreamRequestConfig)cfg).isEnabledForExceptions()) { + Object exception = map.get("faultCause"); + if (exception != null) { + try { + byte[] bytes = (byte[]) exception; + ByteArrayInputStream bais = new ByteArrayInputStream(bytes); + ObjectInputStream ois = new ObjectInputStream(bais); + errorCause = (Throwable) ois.readObject(); + ois.close(); + bais.close(); + } catch (Throwable t) { + // Ignore me + } + } + } } } -- 2.26.0.rc2