33 lines
1014 B
Java
33 lines
1014 B
Java
// Struts2 REST plugin XStreamHandler.toObject() pre-CVE-2017-9805.
|
|
// XStream deserialises XML from HTTP requests with NO type whitelist.
|
|
|
|
package org.apache.struts2.rest.handler;
|
|
|
|
import com.thoughtworks.xstream.XStream;
|
|
import com.thoughtworks.xstream.io.xml.DomDriver;
|
|
|
|
import java.io.InputStream;
|
|
import java.io.Reader;
|
|
|
|
public class XStreamHandler {
|
|
|
|
private final XStream xstream;
|
|
|
|
public XStreamHandler() {
|
|
// BUG: default XStream constructor permits *every* Java class to be
|
|
// instantiated from XML, including ProcessBuilder, dynamic proxies,
|
|
// and the entire XStream gadget chain.
|
|
this.xstream = new XStream(new DomDriver());
|
|
}
|
|
|
|
public Object toObject(Reader in, Class<?> clazz) {
|
|
// No allowlist/security framework configured.
|
|
// Attacker-controlled XML drives object graph instantiation.
|
|
return xstream.fromXML(in);
|
|
}
|
|
|
|
public Object toObject(InputStream in, Class<?> clazz) {
|
|
return xstream.fromXML(in);
|
|
}
|
|
}
|