From febe70f7ca78926660a7d11607a35f663165322a Mon Sep 17 00:00:00 2001 From: Mat Booth Date: Tue, 31 Mar 2020 17:01:29 +0100 Subject: [PATCH 3/6] disallow deserialization of ex serializable tags --- .../xmlrpc/parser/SerializableParser.java | 8 ++++++ .../java/org/apache/xmlrpc/test/BaseTest.java | 28 ------------------- 2 files changed, 8 insertions(+), 28 deletions(-) diff --git a/common/src/main/java/org/apache/xmlrpc/parser/SerializableParser.java b/common/src/main/java/org/apache/xmlrpc/parser/SerializableParser.java index 18f25ac..c8bb7ed 100644 --- a/common/src/main/java/org/apache/xmlrpc/parser/SerializableParser.java +++ b/common/src/main/java/org/apache/xmlrpc/parser/SerializableParser.java @@ -29,6 +29,14 @@ import org.apache.xmlrpc.XmlRpcException; */ public class SerializableParser extends ByteArrayParser { public Object getResult() throws XmlRpcException { + if (!"1".equals(System.getProperty("org.apache.xmlrpc.allowInsecureDeserialization"))) { + throw new UnsupportedOperationException( + "Deserialization of ex:serializable objects is vulnerable to " + + "remote execution attacks and is disabled by default. " + + "If you are sure the source data is trusted, you can enable " + + "it by setting org.apache.xmlrpc.allowInsecureDeserialization " + + "JVM property to 1"); + } try { byte[] res = (byte[]) super.getResult(); ByteArrayInputStream bais = new ByteArrayInputStream(res); diff --git a/server/src/test/java/org/apache/xmlrpc/test/BaseTest.java b/server/src/test/java/org/apache/xmlrpc/test/BaseTest.java index 16699a6..6ad4b5e 100644 --- a/server/src/test/java/org/apache/xmlrpc/test/BaseTest.java +++ b/server/src/test/java/org/apache/xmlrpc/test/BaseTest.java @@ -805,34 +805,6 @@ public class BaseTest extends XmlRpcTestCase { assertTrue(ok); } - /** Test, whether we can invoke a method, passing an instance of - * {@link java.io.Serializable} as a parameter. - * @throws Exception The test failed. - */ - public void testSerializableParam() throws Exception { - for (int i = 0; i < providers.length; i++) { - testSerializableParam(providers[i]); - } - } - - private void testSerializableParam(ClientProvider pProvider) throws Exception { - final String methodName = "Remote.serializableParam"; - Calendar cal = Calendar.getInstance(TimeZone.getTimeZone("GMT")); - cal.set(2005, 5, 23, 8, 4, 0); - cal.set(Calendar.MILLISECOND, 5); - final Object[] params = new Object[]{new Remote.CalendarWrapper(cal)}; - final XmlRpcClient client = pProvider.getClient(); - Object result = client.execute(getExConfig(pProvider), methodName, params); - assertEquals(new Long(cal.getTime().getTime()), result); - boolean ok = false; - try { - client.execute(getConfig(pProvider), methodName, params); - } catch (XmlRpcExtensionException e) { - ok = true; - } - assertTrue(ok); - } - /** Tests, whether we can invoke a method, passing an instance of * {@link Calendar} as a parameter. * @throws Exception The test failed. -- 2.26.0.rc2