[
https://issues.apache.org/jira/browse/TINKERPOP-3278?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=18099866#comment-18099866
]
ASF GitHub Bot commented on TINKERPOP-3278:
-------------------------------------------
xiazcy commented on code in PR #3578:
URL: https://github.com/apache/tinkerpop/pull/3578#discussion_r3669656992
##########
gremlin-core/src/main/java/org/apache/tinkerpop/gremlin/structure/io/gryo/GryoMapper.java:
##########
@@ -78,11 +79,15 @@ public final class GryoMapper implements Mapper<Kryo> {
private final List<TypeRegistration<?>> typeRegistrations;
private final boolean registrationRequired;
private final boolean referenceTracking;
+ private final boolean javaSerializationAllowed;
private final Supplier<ClassResolver> classResolver;
private final GryoVersion version;
private GryoMapper(final Builder builder) {
- this.typeRegistrations = builder.typeRegistrations;
+ this.javaSerializationAllowed = builder.javaSerializationAllowed;
+ this.typeRegistrations = builder.typeRegistrations.stream().
+ filter(tr -> javaSerializationAllowed ||
!(tr.getShadedSerializer() instanceof JavaSerializer)).
Review Comment:
Is there a reason we are doing the filtering of direct `JavaSerializer` here
in the constructor, instead of inside `createMapper()` via the
`resolvesToJavaSerializer` helper with the rest?
> Gryo IO unsafe Java deserialization
> -----------------------------------
>
> Key: TINKERPOP-3278
> URL: https://issues.apache.org/jira/browse/TINKERPOP-3278
> Project: TinkerPop
> Issue Type: Bug
> Components: io
> Affects Versions: 4.0.0, 3.7.7, 3.8.2
> Reporter: Guian Gumpac
> Priority: Major
>
> Gryo registers several {{TraversalStrategy}} types (and
> {{{}TraversalExplanation{}}}) with Kryo's {{{}JavaSerializer{}}}, so reading
> a Gryo document deserializes attacker-controlled bytes via
> {{{}ObjectInputStream.readObject(){}}}.
> Affected: {{gremlin-core}} Gryo IO ({{{}GryoVersion{}}}/{{{}GryoMapper{}}}),
> consumed by {{{}io(){}}}, {{{}GryoReader{}}}, {{{}GryoWriter{}}},
> {{{}GryoIo{}}}, and the Hadoop Gryo IO formats. Gryo 1.0 and 3.0.
> {{JavaSerializer.read()}} wraps the Kryo input in a
> {{java.io.ObjectInputStream}} and calls {{{}readObject(){}}}, which
> reconstructs and runs an arbitrary {{Serializable}} object graph during
> decoding, before any graph-level validation. Reading a Gryo file from an
> untrusted source is therefore an unsafe-deserialization sink: it can cause
> denial of service and, on a classpath with a usable gadget chain, arbitrary
> code execution. Gryo is not on the wire, so the surface is untrusted files
> and OLAP inputs ({{{}io().read(){}}}, {{gryo}} graph persistence,
> Hadoop/Spark).
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
