aboutsummaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorThomas <>2022-03-31 13:00:02 +0200
committerThomas <>2022-03-31 13:00:02 +0200
commit1f76d31e8e8f5a7bc6cd5694b989955ddc2ddc58 (patch)
tree5737a43e21ead7f73725711fc6642206ebec3e72
parentebc5f11b7ff0ca374818445da0a62276a91707dd (diff)
downloadNational_eIDAS_Gateway-1f76d31e8e8f5a7bc6cd5694b989955ddc2ddc58.tar.gz
National_eIDAS_Gateway-1f76d31e8e8f5a7bc6cd5694b989955ddc2ddc58.tar.bz2
National_eIDAS_Gateway-1f76d31e8e8f5a7bc6cd5694b989955ddc2ddc58.zip
feature(core): add deny-list for Spring DataBinder
This mitigates possible RCE attacked called "Spring4Shell"
-rw-r--r--connector/src/main/resources/applicationContext.xml2
-rw-r--r--modules/core_common_webapp/src/main/java/at/asitplus/eidas/specific/core/controller/DataBinderControllerAdvice.java33
2 files changed, 35 insertions, 0 deletions
diff --git a/connector/src/main/resources/applicationContext.xml b/connector/src/main/resources/applicationContext.xml
index ec8e79f4..5c5e245c 100644
--- a/connector/src/main/resources/applicationContext.xml
+++ b/connector/src/main/resources/applicationContext.xml
@@ -28,6 +28,8 @@
<bean id="springContextClosingHandler"
class="at.asitplus.eidas.specific.core.SpringContextCloseHandler" />
+ <bean class="at.asitplus.eidas.specific.core.controller.DataBinderControllerAdvice" />
+
<beans profile="deprecatedConfig">
<bean id="BasicMSSpecificNodeConfig"
class="at.asitplus.eidas.specific.core.config.BasicConfigurationProvider">
diff --git a/modules/core_common_webapp/src/main/java/at/asitplus/eidas/specific/core/controller/DataBinderControllerAdvice.java b/modules/core_common_webapp/src/main/java/at/asitplus/eidas/specific/core/controller/DataBinderControllerAdvice.java
new file mode 100644
index 00000000..0d983c16
--- /dev/null
+++ b/modules/core_common_webapp/src/main/java/at/asitplus/eidas/specific/core/controller/DataBinderControllerAdvice.java
@@ -0,0 +1,33 @@
+package at.asitplus.eidas.specific.core.controller;
+
+import org.apache.commons.lang3.StringUtils;
+import org.springframework.core.annotation.Order;
+import org.springframework.validation.DataBinder;
+import org.springframework.web.bind.WebDataBinder;
+import org.springframework.web.bind.annotation.ControllerAdvice;
+import org.springframework.web.bind.annotation.InitBinder;
+
+import lombok.extern.slf4j.Slf4j;
+
+@ControllerAdvice
+@Order(10000)
+@Slf4j
+public class DataBinderControllerAdvice {
+
+ private static String[] DENYLIST = new String[] { "class.*", "Class.*", "*.class.*", "*.Class.*" };
+
+ /**
+ * Set list of form parameters that are disallowed by default.
+ *
+ * @param dataBinder Spring {@link DataBinder} implementation
+ */
+ @InitBinder
+ public void setDisallowedFields(WebDataBinder dataBinder) {
+ // This code protects Spring Core from a "Remote Code Execution" attack (dubbed "Spring4Shell").
+ // By applying this mitigation, you prevent the "Class Loader Manipulation attack vector from firing.
+ // For more details, see this post: https://www.lunasec.io/docs/blog/spring-rce-vulnerabilities/
+ dataBinder.setDisallowedFields(DENYLIST);
+ log.info("Set denyList for Spring DataBinder: {}", StringUtils.join(DENYLIST, ","));
+
+ }
+}