[
https://issues.apache.org/jira/browse/TINKERPOP-3278?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=18099852#comment-18099852
]
ASF GitHub Bot commented on TINKERPOP-3278:
-------------------------------------------
GumpacG commented on code in PR #3578:
URL: https://github.com/apache/tinkerpop/pull/3578#discussion_r3669214908
##########
docs/src/upgrade/release-3.7.x.asciidoc:
##########
@@ -32,6 +32,47 @@ complete list of all the modifications that are part of this
release.
=== Upgrading for Users
+==== Gryo IO Disables Java Serialization
+
+A small number of Gryo type registrations, mostly `TraversalStrategy`
implementations, were registered with Kryo's
+`JavaSerializer`, which reads by way of
`java.io.ObjectInputStream.readObject()`. Reading a Gryo document from an
+untrusted source was therefore unsafe, as a crafted document could carry an
arbitrary Java object graph that runs
+during decoding.
+
+The paths that consume graph documents, `io()`, `GryoReader`, `GryoWriter` and
`GryoIo` (including `gryo` graph
+persistence) and the Hadoop Gryo input/output formats, no longer install those
registrations. A graph document only needs graph structure, so nothing is lost
+in practice. A stream that does present one of the affected type ids now fails
with an unregistered class id:
+
+[source,text]
+----
+org.apache.tinkerpop.shaded.kryo.KryoException: Encountered unregistered class
ID: 187
+----
+
+The affected types are `PartitionStrategy`, `SubgraphStrategy`,
`SeedStrategy`, `VertexProgramStrategy`,
+`ProductiveByStrategy`, `OptionsStrategy` and `TraversalExplanation` in both
Gryo 1.0 and 3.0, plus
+`GroupStep.GroupBiOperator` and `OrderGlobalStep.OrderBiOperator` in Gryo 1.0.
+
+A mapper built directly is unchanged and keeps full fidelity for trusted,
in-process work such as OLAP. The new
+`GryoMapper.Builder.javaSerializationAllowed(boolean)` selects the behavior:
+
+[source,java]
+----
+// full fidelity, unchanged, appropriate for trusted bytes only
+GryoMapper.build().create();
+
+// hardened, what io() and GryoReader/GryoWriter now use by default
+GryoMapper.build().javaSerializationAllowed(false).create();
+----
+
+Callers that supply their own mapper to `GryoReader` or `GryoWriter` are
unaffected and should add
+`javaSerializationAllowed(false)` if they read bytes they do not control.
`GryoIo` accepts an `onMapper` consumer, so
+full fidelity can be restored where the bytes are trusted:
+
+[source,java]
+----
+GryoIo.build().graph(graph).onMapper(m -> ((GryoMapper.Builder)
m).javaSerializationAllowed(true)).create();
+----
+
Review Comment:
Added a Jira ticket, thanks!
https://issues.apache.org/jira/browse/TINKERPOP-3278
> Gryo IO unsafe Java deserialization
> -----------------------------------
>
> Key: TINKERPOP-3278
> URL: https://issues.apache.org/jira/browse/TINKERPOP-3278
> Project: TinkerPop
> Issue Type: Bug
> Components: io
> Affects Versions: 4.0.0, 3.7.7, 3.8.2
> Reporter: Guian Gumpac
> Priority: Major
>
> Gryo registers several {{TraversalStrategy}} types (and
> {{{}TraversalExplanation{}}}) with Kryo's {{{}JavaSerializer{}}}, so reading
> a Gryo document deserializes attacker-controlled bytes via
> {{{}ObjectInputStream.readObject(){}}}.
> Affected: {{gremlin-core}} Gryo IO ({{{}GryoVersion{}}}/{{{}GryoMapper{}}}),
> consumed by {{{}io(){}}}, {{{}GryoReader{}}}, {{{}GryoWriter{}}},
> {{{}GryoIo{}}}, and the Hadoop Gryo IO formats. Gryo 1.0 and 3.0.
> {{JavaSerializer.read()}} wraps the Kryo input in a
> {{java.io.ObjectInputStream}} and calls {{{}readObject(){}}}, which
> reconstructs and runs an arbitrary {{Serializable}} object graph during
> decoding, before any graph-level validation. Reading a Gryo file from an
> untrusted source is therefore an unsafe-deserialization sink: it can cause
> denial of service and, on a classpath with a usable gadget chain, arbitrary
> code execution. Gryo is not on the wire, so the surface is untrusted files
> and OLAP inputs ({{{}io().read(){}}}, {{gryo}} graph persistence,
> Hadoop/Spark).
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
