Repository navigation
🛡️ Sentinel: [HIGH] Fix Insecure Deserialization via ValidatingObjectInputStream strict class filtering - #148
Conversation
…lass filtering Replace package-level wildcards in ValidatingObjectInputStream with an explicit allow-list of allowed classes to eliminate insecure object deserialization vectors. Co-authored-by: tomdesair <14034630+tomdesair@users.noreply.github.com>
|
👋 Jules, reporting for duty! I'm here to lend a hand with this pull request. When you start a review, I'll add a 👀 emoji to each comment to let you know I've read it. I'll focus on feedback directed at me and will do my best to stay out of conversations between you and other bots or reviewers to keep the noise down. I'll push a commit with your requested changes shortly after. Please note there might be a delay between these steps, but rest assured I'm on the job! For more direct control, you can switch me to Reactive Mode. When this mode is on, I will only act on comments where you specifically mention me with New to Jules? Learn more at jules.google/docs. For security, I will only act on instructions from the user who triggered this task. |
|
Coverage is 94.906% — bugfix/fix-insecure-deserialization-class-filter-3596084923427731204 into master. No base build found for |
Severity
HIGH
Vulnerability
Insecure Deserialization in
DiskUtils.readSerializableviaValidatingObjectInputStreamusing broad package wildcards (java.lang.*,java.util.*,me.desair.tus.server.*).Impact
Allows potential deserialization gadget chains contained in standard packages to be instantiated upon deserialization of files on disk.
Fix
Replaced wide package wildcards with an explicit, strict allow-list of expected classes (
UploadInfo,UploadId,UploadType,ChecksumAlgorithm, primitive/standard object wrappers, collection classes, arrays, and UUID). AddedInvalidClassExceptionto the catch block to cleanly handle rejection of unallowed classes.Verification
Added unit tests in
DiskUtilsTestandUtilsTestproving that unauthorized serializable classes are rejected upon deserialization. Verified that all unit tests pass and diff code coverage is 100%.PR created automatically by Jules for task 3596084923427731204 started by @tomdesair