35 lines
1.1 KiB
Java
35 lines
1.1 KiB
Java
// Clean Java reference - secure XStream usage with explicit allowlist.
|
|
// Looks superficially similar to CVE-2017-9805 but configures typePermissions.
|
|
|
|
package com.example.safe;
|
|
|
|
import com.thoughtworks.xstream.XStream;
|
|
import com.thoughtworks.xstream.io.xml.DomDriver;
|
|
import com.thoughtworks.xstream.security.NoTypePermission;
|
|
import com.thoughtworks.xstream.security.NullPermission;
|
|
import com.thoughtworks.xstream.security.PrimitiveTypePermission;
|
|
|
|
import java.io.Reader;
|
|
|
|
public final class SafeXmlBinder {
|
|
|
|
private final XStream xstream;
|
|
|
|
public SafeXmlBinder(Class<?> allowedRoot) {
|
|
this.xstream = new XStream(new DomDriver());
|
|
|
|
// Lock down deserialisation to a deny-by-default allowlist.
|
|
xstream.addPermission(NoTypePermission.NONE);
|
|
xstream.addPermission(NullPermission.NULL);
|
|
xstream.addPermission(PrimitiveTypePermission.PRIMITIVES);
|
|
xstream.allowTypes(new Class<?>[] { allowedRoot });
|
|
xstream.allowTypesByWildcard(new String[] {
|
|
"com.example.dto.**",
|
|
});
|
|
}
|
|
|
|
public Object fromXml(Reader in) {
|
|
return xstream.fromXML(in);
|
|
}
|
|
}
|