[
https://issues.apache.org/jira/browse/SHIRO-808?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=17262617#comment-17262617
]
Benjamin Marwell commented on SHIRO-808:
----------------------------------------
Hi [~Palak-137] and [~k4n5hao],
the next time you discover a security-relevant issue, please obey Apache’s
security policy:
[https://www.apache.org/security/]
{quote}We strongly encourage the reporting of potential security
vulnerabilities to one of our private security mailing lists first, before
disclosing them in a public forum.
{quote}
We have an appropriate mailing list for this:
[[email protected]|mailto:[email protected]]
Thank you!
[~Palak-137] if you are interested in solving this issue, you are welcome! I
recommend creating a second fork, called "shiro-private" or similar. You can
create a new branch (without creating a pull request!) which includes test etc.
and everything. Just make sure you invite the Apache PMC members before
creating a PR (e.g. using the maill address from above), so we can review your
changes.
The idea here is that the tests should not be public, because they might reveal
a "recipe" on how to exploit a given vulnerability.
Thank you very much!
Ben
> security enhance
> ----------------
>
> Key: SHIRO-808
> URL: https://issues.apache.org/jira/browse/SHIRO-808
> Project: Shiro
> Issue Type: Improvement
> Components: RememberMe
> Affects Versions: 1.7.0
> Reporter: k4n5hao
> Priority: Minor
>
> in file:
> shiro/lang/src/main/java/org/apache/shiro/lang/io/ClassResolvingObjectInputStream.java
> we can find resolveClass funtion
>
> if shiro block these class blow, it can protect shiro with Deserialize
> Vulnerability
> org.apache.commons.collections.functors.ChainedTransformer.transform
> org.apache.commons.collections.functors.InvokerTransformer
> org.apache.commons.collections.functors.InstantiateTransformer
> org.apache.commons.collections4.functors.InvokerTransformer
> org.apache.commons.collections4.functors.InstantiateTransformer
> org.codehaus.groovy.runtime.ConvertedClosure
> org.codehaus.groovy.runtime.MethodClosure
> org.springframework.beans.factory.ObjectFactory
> xalan.internal.xsltc.trax.TemplatesImpl
>
> thx
--
This message was sent by Atlassian Jira
(v8.3.4#803005)
