This is an automated email from the ASF dual-hosted git repository.
mridulpathak pushed a commit to branch trunk
in repository https://gitbox.apache.org/repos/asf/ofbiz-framework.git
The following commit(s) were added to refs/heads/trunk by this push:
new 8c1de31742 Fixed: Enforce the allowed types of the XStream
deserialization in UtilXml (OFBIZ-13647)
8c1de31742 is described below
commit 8c1de317423b5826ae10dd471fd77fff6eacc490
Author: Mridul Pathak <[email protected]>
AuthorDate: Mon Oct 5 11:32:11 2026 +0530
Fixed: Enforce the allowed types of the XStream deserialization in UtilXml
(OFBIZ-13647)
UtilXml configured XStream with allowTypes for a list of simple types and
stated that all the other types are blocked. But allowTypes only adds
permissions: without denying every type first, a type that is not in the list
was still deserialized, unless it is on the default deny list of XStream.
XmlSerializer.deserialize passes any XML whose root element is not ofbiz-ser to
this deserialization, for example the context of a service called through a JMS
message, the data of an entity sy [...]
Every type is now denied first, and only the null value, the primitive
types, the types that were listed, the collection interfaces that XStream uses
for its short elements (list, set, map, sorted-set, sorted-map), and the types
that the fields of a GenericValue need (the unmodifiable map wrapper and the
marker of a null field) are allowed.
---
.../src/main/java/org/apache/ofbiz/base/util/UtilXml.java | 14 ++++++++++++++
1 file changed, 14 insertions(+)
diff --git
a/framework/base/src/main/java/org/apache/ofbiz/base/util/UtilXml.java
b/framework/base/src/main/java/org/apache/ofbiz/base/util/UtilXml.java
index 1c8777d115..9b07332810 100644
--- a/framework/base/src/main/java/org/apache/ofbiz/base/util/UtilXml.java
+++ b/framework/base/src/main/java/org/apache/ofbiz/base/util/UtilXml.java
@@ -79,6 +79,9 @@ import org.xml.sax.SAXParseException;
import org.xml.sax.helpers.DefaultHandler;
import com.thoughtworks.xstream.XStream;
+import com.thoughtworks.xstream.security.NoTypePermission;
+import com.thoughtworks.xstream.security.NullPermission;
+import com.thoughtworks.xstream.security.PrimitiveTypePermission;
/**
* Utilities methods to simplify dealing with JAXP and DOM XML parsing
@@ -93,6 +96,11 @@ public final class UtilXml {
private static XStream createXStream() {
XStream xstream = new XStream();
+ // Deny every type first: allowTypes only adds permissions, and
without this the types that are not allowed
+ // explicitly would still be accepted, except the ones on the deny
list that XStream has by default.
+ xstream.addPermission(NoTypePermission.NONE);
+ xstream.addPermission(NullPermission.NULL);
+ xstream.addPermission(PrimitiveTypePermission.PRIMITIVES);
// Allow only the concrete types that XmlSerializer.serializeSingle
handles explicitly.
// All other types are blocked to prevent deserialization gadget chain
attacks.
// Class names are used as strings to avoid a compile-time dependency
on framework/entity.
@@ -105,6 +113,12 @@ public final class UtilXml {
"java.util.Vector", "java.util.TreeSet", "java.util.HashSet",
"java.util.HashMap", "java.util.Properties",
"java.util.Hashtable",
"java.util.WeakHashMap", "java.util.TreeMap",
+ // The interfaces that XStream uses for the elements <list>,
<set>, <map>, <sorted-set> and <sorted-map>,
+ // their implementations are the types above.
+ "java.util.Collection", "java.util.List", "java.util.Set",
"java.util.SortedSet", "java.util.Map",
+ "java.util.SortedMap",
+ // The wrapper that the maps of a GenericValue can be in, and
the marker of a field that is null.
+ "java.util.Collections$UnmodifiableMap",
"org.apache.ofbiz.entity.GenericEntity$NullField",
"org.apache.ofbiz.entity.GenericValue",
"org.apache.ofbiz.entity.GenericPK"
});
