From 4f6e4801a171d9835a64d048b2e93f108e687fa5 Mon Sep 17 00:00:00 2001
From: Thomas <>
Date: Thu, 31 Mar 2022 13:00:02 +0200
Subject: feature(core): add deny-list for Spring DataBinder

     This mitigates possible RCE attacked called "Spring4Shell"
---
 .../controller/DataBinderControllerAdvice.java     | 33 ++++++++++++++++++++++
 1 file changed, 33 insertions(+)
 create mode 100644 modules/core_common_webapp/src/main/java/at/asitplus/eidas/specific/core/controller/DataBinderControllerAdvice.java

(limited to 'modules/core_common_webapp/src')

diff --git a/modules/core_common_webapp/src/main/java/at/asitplus/eidas/specific/core/controller/DataBinderControllerAdvice.java b/modules/core_common_webapp/src/main/java/at/asitplus/eidas/specific/core/controller/DataBinderControllerAdvice.java
new file mode 100644
index 00000000..0d983c16
--- /dev/null
+++ b/modules/core_common_webapp/src/main/java/at/asitplus/eidas/specific/core/controller/DataBinderControllerAdvice.java
@@ -0,0 +1,33 @@
+package at.asitplus.eidas.specific.core.controller;
+
+import org.apache.commons.lang3.StringUtils;
+import org.springframework.core.annotation.Order;
+import org.springframework.validation.DataBinder;
+import org.springframework.web.bind.WebDataBinder;
+import org.springframework.web.bind.annotation.ControllerAdvice;
+import org.springframework.web.bind.annotation.InitBinder;
+
+import lombok.extern.slf4j.Slf4j;
+
+@ControllerAdvice
+@Order(10000)
+@Slf4j
+public class DataBinderControllerAdvice {
+
+  private static String[] DENYLIST = new String[] { "class.*", "Class.*", "*.class.*", "*.Class.*" };
+  
+  /**
+   * Set list of form parameters that are disallowed by default.
+   * 
+   * @param dataBinder Spring {@link DataBinder} implementation
+   */
+  @InitBinder
+  public void setDisallowedFields(WebDataBinder dataBinder) {
+    // This code protects Spring Core from a "Remote Code Execution" attack (dubbed "Spring4Shell").
+    // By applying this mitigation, you prevent the "Class Loader Manipulation attack vector from firing.
+    // For more details, see this post: https://www.lunasec.io/docs/blog/spring-rce-vulnerabilities/    
+    dataBinder.setDisallowedFields(DENYLIST);
+    log.info("Set denyList for Spring DataBinder: {}", StringUtils.join(DENYLIST, ","));
+
+  }
+}
-- 
cgit v1.2.3