[ https://issues.apache.org/jira/browse/THRIFT-4930?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=16926251#comment-16926251 ]
xiaoqin.fu commented on THRIFT-4930: ------------------------------------ Dear developers: Should I open a PR to fix it? > An information leakage about socket input stream or output stream from > TIOStreamTransport to TSocket > ---------------------------------------------------------------------------------------------------- > > Key: THRIFT-4930 > URL: https://issues.apache.org/jira/browse/THRIFT-4930 > Project: Thrift > Issue Type: Bug > Components: Java - Library > Affects Versions: 0.11.0, 0.12.0 > Environment: Ubuntu 16.04.3 LTS > Open JDK version "1.8.0_191" build 25.191-b12 > Reporter: xiaoqin.fu > Priority: Major > Attachments: TaintPath > > > Operations: During Apache Thrift integration testing, I developed a > calculator application with a client and a server. The client sent a > computational command and get the result from the server. After I applied > dynamic taint analyzer (distTaint), I found bugs from taint paths finally. > The source: org.apache.thrift.transport.TIOStreamTransport: > public int read(byte[] buf, int off, int len) throws TTransportException { > if (inputStream_ == null) { > throw new TTransportException(TTransportException.NOT_OPEN, "Cannot > read from null inputStream"); > } > int bytesRead; > ...... > bytesRead = inputStream_.read(buf, off, len); > ...... > } > The sink: org.apache.thrift.transport.TSocket: > public void close() { > ...... > if (socket_ != null) { > try { > socket_.close(); > } catch (IOException iox) { > LOGGER.warn("Could not close socket.", iox); > } > socket_ = null; > } > } > Sensitive information about socket input stream or output stream is leaked. > The taint path: > org.apache.thrift.transport.TIOStreamTransport --> > org.apache.thrift.transport.TTransport --> > org.apache.thrift.protocol.TBinaryProtocol --> > org.apache.thrift.transport.TTransport --> > org.apache.thrift.protocol.TBinaryProtocol --> > org.apache.thrift.transport.TTransport --> > org.apache.thrift.protocol.TBinaryProtocol --> > org.apache.thrift.transport.TTransport --> > org.apache.thrift.protocol.TBinaryProtocol --> > org.apache.thrift.transport.TTransport --> > org.apache.thrift.protocol.TBinaryProtocol --> > org.apache.thrift.transport.TTransport --> > org.apache.thrift.protocol.TBinaryProtocol --> > org.apache.thrift.transport.TTransport --> > CalculatorService$add_result$add_resultStandardScheme --> > org.apache.thrift.protocol.TBinaryProtocol --> > org.apache.thrift.TServiceClient --> > org.apache.thrift.protocol.TBinaryProtocol --> > org.apache.thrift.transport.TIOStreamTransport --> > CalculatorService$add_result$add_resultStandardScheme --> > org.apache.thrift.protocol.TBinaryProtocol --> > org.apache.thrift.transport.TIOStreamTransport --> > CalculatorService$add_result$add_resultStandardScheme --> > org.apache.thrift.protocol.TBinaryProtocol --> > CalculatorService$Client --> > org.apache.thrift.protocol.TMessage --> > org.apache.thrift.protocol.TField --> > org.apache.thrift.protocol.TBinaryProtocol --> > CalculatorService$add_result$add_resultStandardScheme --> > org.apache.thrift.protocol.TBinaryProtocol --> > CalculatorService$add_result$add_resultStandardScheme --> > org.apache.thrift.protocol.TBinaryProtocol --> > org.apache.thrift.protocol.TField --> > CalculatorService$Client --> > org.apache.thrift.protocol.TBinaryProtocol --> > CalculatorService$add_result --> > org.apache.thrift.TServiceClient --> > org.apache.thrift.protocol.TBinaryProtocol --> > org.apache.thrift.TServiceClient --> > org.apache.thrift.protocol.TField --> > CalculatorService$add_result$add_resultStandardScheme --> > org.apache.thrift.protocol.TBinaryProtocol --> > CalculatorService$Client --> > org.apache.thrift.protocol.TBinaryProtocol --> > CalculatorService$Client --> > org.apache.thrift.protocol.TBinaryProtocol --> > org.apache.thrift.protocol.TMessage --> > org.apache.thrift.protocol.TBinaryProtocol --> > org.apache.thrift.TServiceClient --> > org.apache.thrift.protocol.TBinaryProtocol --> > org.apache.thrift.TServiceClient --> > org.apache.thrift.protocol.TBinaryProtocol --> > CalculatorService$add_result$add_resultStandardScheme --> > org.apache.thrift.protocol.TBinaryProtocol --> > org.apache.thrift.protocol.TMessage --> > CalculatorService$add_result$add_resultStandardScheme --> > CalculatorService$add_args --> > org.apache.thrift.protocol.TBinaryProtocol --> > CalculatorService$add_result --> > CalculatorService$add_args --> > org.apache.thrift.TServiceClient --> > CalculatorService$add_result --> > org.apache.thrift.protocol.TBinaryProtocol --> > CalculatorService$add_args --> > CalculatorService$add_result$add_resultStandardScheme --> > CalculatorService$add_result --> > org.apache.thrift.EncodingUtils --> > CalculatorClient --> > CalculatorService$add_result --> > org.apache.thrift.protocol.TBinaryProtocol --> > org.apache.thrift.TServiceClient --> > org.apache.thrift.protocol.TBinaryProtocol --> > CalculatorService$add_result --> > org.apache.thrift.protocol.TBinaryProtocol --> > org.apache.thrift.EncodingUtils --> > org.apache.thrift.protocol.TBinaryProtocol --> > org.apache.thrift.EncodingUtils --> > org.apache.thrift.protocol.TBinaryProtocol --> > org.apache.thrift.EncodingUtils --> > CalculatorService$add_args --> > CalculatorService$add_args$add_argsStandardSchemeFactory --> > CalculatorClient --> > org.apache.thrift.protocol.TBinaryProtocol --> > CalculatorService$add_result$add_resultStandardSchemeFactory --> > CalculatorService$add_result --> > org.apache.thrift.protocol.TBinaryProtocol --> > CalculatorClient --> > org.apache.thrift.protocol.TBinaryProtocol --> > CalculatorService$add_args --> > org.apache.thrift.protocol.TBinaryProtocol --> > CalculatorService$add_args --> > org.apache.thrift.protocol.TBinaryProtocol --> > CalculatorClient --> > CalculatorService$add_result --> > org.apache.thrift.protocol.TBinaryProtocol --> > org.apache.thrift.transport.TSocket > I am going to submit a CVE, so please confirm this is not a true positive. -- This message was sent by Atlassian Jira (v8.3.2#803003)