From 1114eba5bfeeb4cd9fe5bb744e30ff3792309bb3 Mon Sep 17 00:00:00 2001 From: Marian Koncek Date: Wed, 11 Dec 2019 13:27:47 +0100 Subject: [PATCH] CVE-2019-10086 --- .../commons/beanutils/PropertyUtilsBean.java | 1 + .../BeanIntrospectionDataTestCase.java | 1 + .../beanutils/bugs/Jira157TestCase.java | 7 +++ .../beanutils/bugs/Jira520TestCase.java | 55 +++++++++++++++++++ 4 files changed, 64 insertions(+) create mode 100644 src/test/java/org/apache/commons/beanutils/bugs/Jira520TestCase.java diff --git a/src/main/java/org/apache/commons/beanutils/PropertyUtilsBean.java b/src/main/java/org/apache/commons/beanutils/PropertyUtilsBean.java index ff0b2ee..4e55061 100644 --- a/src/main/java/org/apache/commons/beanutils/PropertyUtilsBean.java +++ b/src/main/java/org/apache/commons/beanutils/PropertyUtilsBean.java @@ -188,6 +188,7 @@ public class PropertyUtilsBean { public final void resetBeanIntrospectors() { introspectors.clear(); introspectors.add(DefaultBeanIntrospector.INSTANCE); + introspectors.add(SuppressPropertiesBeanIntrospector.SUPPRESS_CLASS); } /** diff --git a/src/test/java/org/apache/commons/beanutils/BeanIntrospectionDataTestCase.java b/src/test/java/org/apache/commons/beanutils/BeanIntrospectionDataTestCase.java index da8c22c..3a6c566 100644 --- a/src/test/java/org/apache/commons/beanutils/BeanIntrospectionDataTestCase.java +++ b/src/test/java/org/apache/commons/beanutils/BeanIntrospectionDataTestCase.java @@ -42,6 +42,7 @@ public class BeanIntrospectionDataTestCase extends TestCase { */ private static PropertyDescriptor[] fetchDescriptors() { final PropertyUtilsBean pub = new PropertyUtilsBean(); + pub.removeBeanIntrospector(SuppressPropertiesBeanIntrospector.SUPPRESS_CLASS); pub.addBeanIntrospector(new FluentPropertyBeanIntrospector()); return pub.getPropertyDescriptors(BEAN_CLASS); } diff --git a/src/test/java/org/apache/commons/beanutils/bugs/Jira157TestCase.java b/src/test/java/org/apache/commons/beanutils/bugs/Jira157TestCase.java index 97f7bae..5611b03 100644 --- a/src/test/java/org/apache/commons/beanutils/bugs/Jira157TestCase.java +++ b/src/test/java/org/apache/commons/beanutils/bugs/Jira157TestCase.java @@ -24,6 +24,9 @@ import junit.framework.TestCase; import junit.framework.TestSuite; import org.apache.commons.beanutils.BeanUtils; +import org.apache.commons.beanutils.BeanUtilsBean; +import org.apache.commons.beanutils.PropertyUtilsBean; +import org.apache.commons.beanutils.SuppressPropertiesBeanIntrospector; import org.apache.commons.logging.Log; import org.apache.commons.logging.LogFactory; @@ -74,6 +77,10 @@ public class Jira157TestCase extends TestCase { @Override protected void setUp() throws Exception { super.setUp(); + + BeanUtilsBean custom = new BeanUtilsBean(); + custom.getPropertyUtils().removeBeanIntrospector(SuppressPropertiesBeanIntrospector.SUPPRESS_CLASS); + BeanUtilsBean.setInstance(custom); } /** diff --git a/src/test/java/org/apache/commons/beanutils/bugs/Jira520TestCase.java b/src/test/java/org/apache/commons/beanutils/bugs/Jira520TestCase.java new file mode 100644 index 0000000..c5f6cfb --- /dev/null +++ b/src/test/java/org/apache/commons/beanutils/bugs/Jira520TestCase.java @@ -0,0 +1,55 @@ +/* + * Licensed to the Apache Software Foundation (ASF) under one or more + * contributor license agreements. See the NOTICE file distributed with + * this work for additional information regarding copyright ownership. + * The ASF licenses this file to You under the Apache License, Version 2.0 + * (the "License"); you may not use this file except in compliance with + * the License. You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ +package org.apache.commons.beanutils.bugs; + +import org.apache.commons.beanutils.AlphaBean; +import org.apache.commons.beanutils.BeanUtilsBean; +import org.apache.commons.beanutils.SuppressPropertiesBeanIntrospector; + +import junit.framework.TestCase; + +/** + * Fix CVE: https://nvd.nist.gov/vuln/detail/CVE-2014-0114 + * + * @see https://issues.apache.org/jira/browse/BEANUTILS-520 + */ +public class Jira520TestCase extends TestCase { + /** + * By default opt-in to security that does not allow access to "class". + */ + public void testSuppressClassPropertyByDefault() throws Exception { + final BeanUtilsBean bub = new BeanUtilsBean(); + final AlphaBean bean = new AlphaBean(); + try { + bub.getProperty(bean, "class"); + fail("Could access class property!"); + } catch (final NoSuchMethodException ex) { + // ok + } + } + + /** + * Allow opt-out to make your app less secure but allow access to "class". + */ + public void testAllowAccessToClassProperty() throws Exception { + final BeanUtilsBean bub = new BeanUtilsBean(); + bub.getPropertyUtils().removeBeanIntrospector(SuppressPropertiesBeanIntrospector.SUPPRESS_CLASS); + final AlphaBean bean = new AlphaBean(); + String result = bub.getProperty(bean, "class"); + assertEquals("Class property should have been accessed", "class org.apache.commons.beanutils.AlphaBean", result); + } +} -- 2.21.0