[java-sig-commits] [Bug 1908832] CVE-2020-26258 XStream: Server-Side Forgery Request vulnerability can be activated when unmarshalling

https://bugzilla.redhat.com/show_bug.cgi?id=1908832

--- Comment #4 from Paramvir jindal  ---
Mitigation:

As recommended, use XStream's security framework to implement a whitelist for
the allowed types.

Users of XStream 1.4.14 who insist to use XStream default blacklist - despite
that clear recommendation - can simply add two lines to XStream's setup code:

xstream.denyTypes(new String[]{ "jdk.nashorn.internal.objects.NativeString" });
xstream.denyTypesByRegExp(new String[]{ ".*\.ReadAllStream\$FileStream" });

Users of XStream 1.4.13 who want to use XStream default blacklist can simply
add three lines to XStream's setup code:

xstream.denyTypes(new String[]{ "javax.imageio.ImageIO$ContainsFilter",
"jdk.nashorn.internal.objects.NativeString" });
xstream.denyTypes(new Class[]{ java.lang.ProcessBuilder.class });
xstream.denyTypesByRegExp(new String[]{ ".*\.ReadAllStream\$FileStream" });

Users of XStream 1.4.12 to 1.4.7 who want to use XStream with a blacklist will
have to setup such a list from scratch and deny at least the following types:
javax.imageio.ImageIO$ContainsFilter, java.beans.EventHandler,
java.lang.ProcessBuilder, jdk.nashorn.internal.objects.NativeString,
java.lang.Void and void and deny several types by name pattern.

xstream.denyTypes(new String[]{ "javax.imageio.ImageIO$ContainsFilter",
"jdk.nashorn.internal.objects.NativeString" });
xstream.denyTypes(new Class[]{ java.lang.ProcessBuilder.class,
java.beans.EventHandler.class, java.lang.ProcessBuilder.class,
java.lang.Void.class, void.class });
xstream.denyTypesByRegExp(new String[]{ ".*\$LazyIterator",
"javax\.crypto\..*", ".*\.ReadAllStream\$FileStream" });

Users of XStream 1.4.6 or below can register an own converter to prevent the
unmarshalling of the currently know critical types of the Java runtime. It is
in fact an updated version of the workaround for CVE-2013-7285:

xstream.registerConverter(new Converter() {
  public boolean canConvert(Class type) {
    return type != null && (type == java.beans.EventHandler.class || type ==
java.lang.ProcessBuilder.class
        || type.getName().equals("javax.imageio.ImageIO$ContainsFilter") ||
type.getName().equals("jdk.nashorn.internal.objects.NativeString")
        || type == java.lang.Void.class || void.class || Proxy.isProxy(type)
        || type.getName().startsWith("javax.crypto.") ||
type.getName().endsWith("$LazyIterator") ||
type.getName().endsWith(".ReadAllStream$FileStream"));
  }

public Object unmarshal(HierarchicalStreamReader reader, UnmarshallingContext
context) {
    throw new ConversionException("Unsupported type due to security reasons.");
  }

public void marshal(Object source, HierarchicalStreamWriter writer,
MarshallingContext context) {
    throw new ConversionException("Unsupported type due to security reasons.");
  }
}, XStream.PRIORITY_LOW);