From 701ea95a52afe53bee28f76a3f96eb0e578852e9 Mon Sep 17 00:00:00 2001 From: Daniel Beck Date: Sun, 16 Apr 2017 10:06:15 +0200 Subject: [PATCH 1/2] [SECURITY-503] Prevent deserialization of void/Void --- core/src/main/java/hudson/util/XStream2.java | 3 +++ core/src/test/java/hudson/util/XStream2Test.java | 12 ++++++++++++ 2 files changed, 15 insertions(+) diff --git a/core/src/main/java/hudson/util/XStream2.java b/core/src/main/java/hudson/util/XStream2.java index bfe924e70a..9a514b3449 100644 --- a/core/src/main/java/hudson/util/XStream2.java +++ b/core/src/main/java/hudson/util/XStream2.java @@ -145,6 +145,9 @@ public class XStream2 extends XStream { // list up types that should be marshalled out like a value, without referential integrity tracking. addImmutableType(Result.class); + // http://www.openwall.com/lists/oss-security/2017/04/03/4 + denyTypes(new Class[] { void.class, Void.class }); + registerConverter(new RobustCollectionConverter(getMapper(),getReflectionProvider()),10); registerConverter(new RobustMapConverter(getMapper()), 10); registerConverter(new ImmutableMapConverter(getMapper(),getReflectionProvider()),10); diff --git a/core/src/test/java/hudson/util/XStream2Test.java b/core/src/test/java/hudson/util/XStream2Test.java index aeb781f672..08170e24d4 100644 --- a/core/src/test/java/hudson/util/XStream2Test.java +++ b/core/src/test/java/hudson/util/XStream2Test.java @@ -28,6 +28,7 @@ import static org.junit.Assert.*; import com.google.common.collect.ImmutableList; import com.google.common.collect.ImmutableMap; import com.thoughtworks.xstream.XStreamException; +import com.thoughtworks.xstream.security.ForbiddenClassException; import hudson.XmlFile; import hudson.model.Result; import hudson.model.Run; @@ -296,4 +297,15 @@ public class XStream2Test { assertEquals("3.2.1", XStream2.trimVersion("3.2.1")); assertEquals("3.2-SNAPSHOT", XStream2.trimVersion("3.2-SNAPSHOT (private-09/23/2012 12:26-jhacker)")); } + + @Issue("SECURITY-503") + @Test + public void crashXstream() throws Exception { + try { + new XStream2().fromXML(""); + fail("expected to throw ForbiddenClassException, but why are we still alive?"); + } catch (ForbiddenClassException ex) { + // pass + } + } } From ce5c517433e4b0c1685e6d6037227dbc94d97081 Mon Sep 17 00:00:00 2001 From: Daniel Beck Date: Sun, 16 Apr 2017 11:07:58 +0200 Subject: [PATCH 2/2] Revert "[SECURITY-420] RequirePOST to finish setup wizard" This reverts commit 416fdddb97f8a6f8778a66bfe38d5eb39a77149c. --- core/src/main/java/jenkins/install/SetupWizard.java | 1 - war/src/main/js/api/pluginManager.js | 2 +- 2 files changed, 1 insertion(+), 2 deletions(-) diff --git a/core/src/main/java/jenkins/install/SetupWizard.java b/core/src/main/java/jenkins/install/SetupWizard.java index 0f3567ff9f..2d98160b9b 100644 --- a/core/src/main/java/jenkins/install/SetupWizard.java +++ b/core/src/main/java/jenkins/install/SetupWizard.java @@ -443,7 +443,6 @@ public class SetupWizard extends PageDecorator { /** * Remove the setupWizard filter, ensure all updates are written to disk, etc */ - @RequirePOST public HttpResponse doCompleteInstall() throws IOException, ServletException { completeSetup(); return HttpResponses.okJSON(); diff --git a/war/src/main/js/api/pluginManager.js b/war/src/main/js/api/pluginManager.js index 1af7995c1b..3f2cf7fedb 100644 --- a/war/src/main/js/api/pluginManager.js +++ b/war/src/main/js/api/pluginManager.js @@ -177,7 +177,7 @@ exports.incompleteInstallStatus = function(handler, correlationId) { * Call this to complete the installation without installing anything */ exports.completeInstall = function(handler) { - jenkins.post('/setupWizard/completeInstall', {}, function() { + jenkins.get('/setupWizard/completeInstall', function() { handler.call({ isError: false }); }, { timeout: pluginManagerErrorTimeoutMillis,