From 942fb62a525ca49dfd1845a309d9cbc76d612c17 Mon Sep 17 00:00:00 2001 From: Thomas <> Date: Thu, 17 Mar 2022 08:09:55 +0100 Subject: build(core): switch to next snapshot version --- modules/core_common_webapp/pom.xml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) (limited to 'modules/core_common_webapp') diff --git a/modules/core_common_webapp/pom.xml b/modules/core_common_webapp/pom.xml index b36153e6..a7090761 100644 --- a/modules/core_common_webapp/pom.xml +++ b/modules/core_common_webapp/pom.xml @@ -3,7 +3,7 @@ at.asitplus.eidas.ms_specific modules - 1.2.4-SNAPSHOT + 1.3.0-SNAPSHOT core_common_webapp WebApplication commons -- cgit v1.2.3 From 1f76d31e8e8f5a7bc6cd5694b989955ddc2ddc58 Mon Sep 17 00:00:00 2001 From: Thomas <> Date: Thu, 31 Mar 2022 13:00:02 +0200 Subject: feature(core): add deny-list for Spring DataBinder This mitigates possible RCE attacked called "Spring4Shell" --- .../src/main/resources/applicationContext.xml | 2 ++ .../controller/DataBinderControllerAdvice.java | 33 ++++++++++++++++++++++ 2 files changed, 35 insertions(+) create mode 100644 modules/core_common_webapp/src/main/java/at/asitplus/eidas/specific/core/controller/DataBinderControllerAdvice.java (limited to 'modules/core_common_webapp') diff --git a/connector/src/main/resources/applicationContext.xml b/connector/src/main/resources/applicationContext.xml index ec8e79f4..5c5e245c 100644 --- a/connector/src/main/resources/applicationContext.xml +++ b/connector/src/main/resources/applicationContext.xml @@ -28,6 +28,8 @@ + + diff --git a/modules/core_common_webapp/src/main/java/at/asitplus/eidas/specific/core/controller/DataBinderControllerAdvice.java b/modules/core_common_webapp/src/main/java/at/asitplus/eidas/specific/core/controller/DataBinderControllerAdvice.java new file mode 100644 index 00000000..0d983c16 --- /dev/null +++ b/modules/core_common_webapp/src/main/java/at/asitplus/eidas/specific/core/controller/DataBinderControllerAdvice.java @@ -0,0 +1,33 @@ +package at.asitplus.eidas.specific.core.controller; + +import org.apache.commons.lang3.StringUtils; +import org.springframework.core.annotation.Order; +import org.springframework.validation.DataBinder; +import org.springframework.web.bind.WebDataBinder; +import org.springframework.web.bind.annotation.ControllerAdvice; +import org.springframework.web.bind.annotation.InitBinder; + +import lombok.extern.slf4j.Slf4j; + +@ControllerAdvice +@Order(10000) +@Slf4j +public class DataBinderControllerAdvice { + + private static String[] DENYLIST = new String[] { "class.*", "Class.*", "*.class.*", "*.Class.*" }; + + /** + * Set list of form parameters that are disallowed by default. + * + * @param dataBinder Spring {@link DataBinder} implementation + */ + @InitBinder + public void setDisallowedFields(WebDataBinder dataBinder) { + // This code protects Spring Core from a "Remote Code Execution" attack (dubbed "Spring4Shell"). + // By applying this mitigation, you prevent the "Class Loader Manipulation attack vector from firing. + // For more details, see this post: https://www.lunasec.io/docs/blog/spring-rce-vulnerabilities/ + dataBinder.setDisallowedFields(DENYLIST); + log.info("Set denyList for Spring DataBinder: {}", StringUtils.join(DENYLIST, ",")); + + } +} -- cgit v1.2.3 From deb287570c9248b9cf39af981a976c335f434b84 Mon Sep 17 00:00:00 2001 From: Thomas <> Date: Thu, 31 Mar 2022 14:36:02 +0200 Subject: chore(core): change log-level in 'DataBinderControllerAdvice' --- .../eidas/specific/core/controller/DataBinderControllerAdvice.java | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) (limited to 'modules/core_common_webapp') diff --git a/modules/core_common_webapp/src/main/java/at/asitplus/eidas/specific/core/controller/DataBinderControllerAdvice.java b/modules/core_common_webapp/src/main/java/at/asitplus/eidas/specific/core/controller/DataBinderControllerAdvice.java index 0d983c16..e69826d0 100644 --- a/modules/core_common_webapp/src/main/java/at/asitplus/eidas/specific/core/controller/DataBinderControllerAdvice.java +++ b/modules/core_common_webapp/src/main/java/at/asitplus/eidas/specific/core/controller/DataBinderControllerAdvice.java @@ -27,7 +27,7 @@ public class DataBinderControllerAdvice { // By applying this mitigation, you prevent the "Class Loader Manipulation attack vector from firing. // For more details, see this post: https://www.lunasec.io/docs/blog/spring-rce-vulnerabilities/ dataBinder.setDisallowedFields(DENYLIST); - log.info("Set denyList for Spring DataBinder: {}", StringUtils.join(DENYLIST, ",")); + log.trace("Set denyList for Spring DataBinder: {}", StringUtils.join(DENYLIST, ",")); } } -- cgit v1.2.3 From ecc1dd834c5af467a5aa0f77e5dc6d986c6af418 Mon Sep 17 00:00:00 2001 From: Thomas <> Date: Tue, 5 Apr 2022 08:59:31 +0200 Subject: build(core): switch to new snapshot version --- build_reporting/pom.xml | 2 +- connector/pom.xml | 2 +- modules/authmodule-eIDAS-v2/pom.xml | 2 +- modules/core_common_lib/pom.xml | 2 +- modules/core_common_webapp/pom.xml | 2 +- modules/pom.xml | 2 +- pom.xml | 2 +- 7 files changed, 7 insertions(+), 7 deletions(-) (limited to 'modules/core_common_webapp') diff --git a/build_reporting/pom.xml b/build_reporting/pom.xml index d0a3c817..05473715 100644 --- a/build_reporting/pom.xml +++ b/build_reporting/pom.xml @@ -6,7 +6,7 @@ at.asitplus.eidas ms_specific - 1.3.0-SNAPSHOT + 1.2.5-SNAPSHOT build_reporting pom diff --git a/connector/pom.xml b/connector/pom.xml index 2358881e..08e83cd8 100644 --- a/connector/pom.xml +++ b/connector/pom.xml @@ -6,7 +6,7 @@ at.asitplus.eidas ms_specific - 1.3.0-SNAPSHOT + 1.2.5-SNAPSHOT at.asitplus.eidas.ms_specific diff --git a/modules/authmodule-eIDAS-v2/pom.xml b/modules/authmodule-eIDAS-v2/pom.xml index 94c46e63..105d16f0 100644 --- a/modules/authmodule-eIDAS-v2/pom.xml +++ b/modules/authmodule-eIDAS-v2/pom.xml @@ -6,7 +6,7 @@ at.asitplus.eidas.ms_specific modules - 1.3.0-SNAPSHOT + 1.2.5-SNAPSHOT at.asitplus.eidas.ms_specific.modules authmodule-eIDAS-v2 diff --git a/modules/core_common_lib/pom.xml b/modules/core_common_lib/pom.xml index 3cf4e66c..b5a95005 100644 --- a/modules/core_common_lib/pom.xml +++ b/modules/core_common_lib/pom.xml @@ -7,7 +7,7 @@ at.asitplus.eidas.ms_specific modules - 1.3.0-SNAPSHOT + 1.2.5-SNAPSHOT core_common_lib ms_specific_common_lib diff --git a/modules/core_common_webapp/pom.xml b/modules/core_common_webapp/pom.xml index a7090761..a7efdf15 100644 --- a/modules/core_common_webapp/pom.xml +++ b/modules/core_common_webapp/pom.xml @@ -3,7 +3,7 @@ at.asitplus.eidas.ms_specific modules - 1.3.0-SNAPSHOT + 1.2.5-SNAPSHOT core_common_webapp WebApplication commons diff --git a/modules/pom.xml b/modules/pom.xml index a6e9c696..fff02aa5 100644 --- a/modules/pom.xml +++ b/modules/pom.xml @@ -4,7 +4,7 @@ at.asitplus.eidas ms_specific - 1.3.0-SNAPSHOT + 1.2.5-SNAPSHOT at.asitplus.eidas.ms_specific modules diff --git a/pom.xml b/pom.xml index 4ae464ba..c632f42c 100644 --- a/pom.xml +++ b/pom.xml @@ -5,7 +5,7 @@ 4.0.0 at.asitplus.eidas ms_specific - 1.3.0-SNAPSHOT + 1.2.5-SNAPSHOT pom MS specific eIDAS components -- cgit v1.2.3