AnnJoy23 commented on code in PR #4341:
URL:
https://github.com/apache/incubator-kie-kogito-runtimes/pull/4341#discussion_r3585033537
##########
quarkus/extensions/kogito-quarkus-rules-extension/kogito-quarkus-rules/src/main/java/org/kie/kogito/core/rules/incubation/quarkus/support/RuleUnitServiceImpl.java:
##########
@@ -36,6 +37,9 @@
class RuleUnitServiceImpl implements RuleUnitService {
+ // CWE-470: validate class name is a legal Java FQCN before passing to
loadClass
+ private static final Pattern SAFE_CLASS_NAME =
Pattern.compile("[\\w$]+(\\.[\\w$]+)*");
Review Comment:
The current pattern [\w$]+(\.[\w$]+)* is sufficient to break the CWE-470
taint chain. The only difference between the two patterns is that it permits
digit-starting segments (e.g. "1abc.Foo"), which are not valid Java class names
but would fail ClassLoader.loadClass() at runtime regardless. All
injection-relevant characters (/, ;, .., spaces) are blocked equally by both
patterns.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
