diff options
author | Thomas <> | 2022-03-31 13:00:02 +0200 |
---|---|---|
committer | Thomas <> | 2022-03-31 13:15:35 +0200 |
commit | 4f6e4801a171d9835a64d048b2e93f108e687fa5 (patch) | |
tree | 36896d4672b7e502f3660258edfd1adb0ecc4281 /modules/core_common_webapp/src/main | |
parent | eb301932e03e01ff61990ba578fd55996052eab4 (diff) | |
download | National_eIDAS_Gateway-4f6e4801a171d9835a64d048b2e93f108e687fa5.tar.gz National_eIDAS_Gateway-4f6e4801a171d9835a64d048b2e93f108e687fa5.tar.bz2 National_eIDAS_Gateway-4f6e4801a171d9835a64d048b2e93f108e687fa5.zip |
feature(core): add deny-list for Spring DataBinder
This mitigates possible RCE attacked called "Spring4Shell"
Diffstat (limited to 'modules/core_common_webapp/src/main')
-rw-r--r-- | modules/core_common_webapp/src/main/java/at/asitplus/eidas/specific/core/controller/DataBinderControllerAdvice.java | 33 |
1 files changed, 33 insertions, 0 deletions
diff --git a/modules/core_common_webapp/src/main/java/at/asitplus/eidas/specific/core/controller/DataBinderControllerAdvice.java b/modules/core_common_webapp/src/main/java/at/asitplus/eidas/specific/core/controller/DataBinderControllerAdvice.java new file mode 100644 index 00000000..0d983c16 --- /dev/null +++ b/modules/core_common_webapp/src/main/java/at/asitplus/eidas/specific/core/controller/DataBinderControllerAdvice.java @@ -0,0 +1,33 @@ +package at.asitplus.eidas.specific.core.controller; + +import org.apache.commons.lang3.StringUtils; +import org.springframework.core.annotation.Order; +import org.springframework.validation.DataBinder; +import org.springframework.web.bind.WebDataBinder; +import org.springframework.web.bind.annotation.ControllerAdvice; +import org.springframework.web.bind.annotation.InitBinder; + +import lombok.extern.slf4j.Slf4j; + +@ControllerAdvice +@Order(10000) +@Slf4j +public class DataBinderControllerAdvice { + + private static String[] DENYLIST = new String[] { "class.*", "Class.*", "*.class.*", "*.Class.*" }; + + /** + * Set list of form parameters that are disallowed by default. + * + * @param dataBinder Spring {@link DataBinder} implementation + */ + @InitBinder + public void setDisallowedFields(WebDataBinder dataBinder) { + // This code protects Spring Core from a "Remote Code Execution" attack (dubbed "Spring4Shell"). + // By applying this mitigation, you prevent the "Class Loader Manipulation attack vector from firing. + // For more details, see this post: https://www.lunasec.io/docs/blog/spring-rce-vulnerabilities/ + dataBinder.setDisallowedFields(DENYLIST); + log.info("Set denyList for Spring DataBinder: {}", StringUtils.join(DENYLIST, ",")); + + } +} |