This is an automated email from the ASF dual-hosted git repository.
mridulpathak pushed a commit to branch release24.09
in repository https://gitbox.apache.org/repos/asf/ofbiz-framework.git
The following commit(s) were added to refs/heads/release24.09 by this push:
new 03d0ded5c6 Fixed: Enforce the allowed types of the XStream
deserialization in UtilXml (OFBIZ-13647)
03d0ded5c6 is described below
commit 03d0ded5c6e75e3017b96d53f6ccd662a3d2dab4
Author: Mridul Pathak <[email protected]>
AuthorDate: Mon Oct 5 11:32:11 2026 +0530
Fixed: Enforce the allowed types of the XStream deserialization in UtilXml
(OFBIZ-13647)
UtilXml configured XStream with allowTypes for a list of simple types and
stated that all the other types are blocked. But allowTypes only adds
permissions: without denying every type first, a type that is not in the list
was still deserialized, unless it is on the default deny list of XStream.
XmlSerializer.deserialize passes any XML whose root element is not ofbiz-ser to
this deserialization, for example the context of a service called through a JMS
message, the data of an entity sy [...]
Every type is now denied first, and only the null value, the primitive
types, the types that were listed, the collection interfaces that XStream uses
for its short elements (list, set, map, sorted-set, sorted-map), and the types
that the fields of a GenericValue need (the unmodifiable map wrapper and the
marker of a null field) are allowed.
(cherry picked from commit 7d6d7fa1f45d8fd890d3ff871d168810b8b541ee)
---
.../src/main/java/org/apache/ofbiz/base/util/UtilXml.java | 14 ++++++++++++++
1 file changed, 14 insertions(+)
diff --git
a/framework/base/src/main/java/org/apache/ofbiz/base/util/UtilXml.java
b/framework/base/src/main/java/org/apache/ofbiz/base/util/UtilXml.java
index 6107279584..9a59733f25 100644
--- a/framework/base/src/main/java/org/apache/ofbiz/base/util/UtilXml.java
+++ b/framework/base/src/main/java/org/apache/ofbiz/base/util/UtilXml.java
@@ -78,6 +78,9 @@ import org.xml.sax.SAXParseException;
import org.xml.sax.helpers.DefaultHandler;
import com.thoughtworks.xstream.XStream;
+import com.thoughtworks.xstream.security.NoTypePermission;
+import com.thoughtworks.xstream.security.NullPermission;
+import com.thoughtworks.xstream.security.PrimitiveTypePermission;
/**
* Utilities methods to simplify dealing with JAXP and DOM XML parsing
@@ -92,6 +95,11 @@ public final class UtilXml {
private static XStream createXStream() {
XStream xstream = new XStream();
+ // Deny every type first: allowTypes only adds permissions, and
without this the types that are not allowed
+ // explicitly would still be accepted, except the ones on the deny
list that XStream has by default.
+ xstream.addPermission(NoTypePermission.NONE);
+ xstream.addPermission(NullPermission.NULL);
+ xstream.addPermission(PrimitiveTypePermission.PRIMITIVES);
// Allow only the concrete types that XmlSerializer.serializeSingle
handles explicitly.
// All other types are blocked to prevent deserialization gadget chain
attacks.
// Class names are used as strings to avoid a compile-time dependency
on framework/entity.
@@ -104,6 +112,12 @@ public final class UtilXml {
"java.util.Vector", "java.util.TreeSet", "java.util.HashSet",
"java.util.HashMap", "java.util.Properties",
"java.util.Hashtable",
"java.util.WeakHashMap", "java.util.TreeMap",
+ // The interfaces that XStream uses for the elements <list>,
<set>, <map>, <sorted-set> and <sorted-map>,
+ // their implementations are the types above.
+ "java.util.Collection", "java.util.List", "java.util.Set",
"java.util.SortedSet", "java.util.Map",
+ "java.util.SortedMap",
+ // The wrapper that the maps of a GenericValue can be in, and
the marker of a field that is null.
+ "java.util.Collections$UnmodifiableMap",
"org.apache.ofbiz.entity.GenericEntity$NullField",
"org.apache.ofbiz.entity.GenericValue",
"org.apache.ofbiz.entity.GenericPK"
});
