Skip to content

Commit 17a741d

Browse files
AlekseiEfimovslowhog
authored andcommitted
8244473: Contextualize registration for JNDI
Also reviewed by Chris Ries <chris.ries@oracle.com> Reviewed-by: dfuchs, rriggs, rhalade, skoivu, mullan
1 parent f47faf2 commit 17a741d

8 files changed

Lines changed: 251 additions & 13 deletions

File tree

src/java.base/share/conf/security/java.security

Lines changed: 23 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1326,3 +1326,26 @@ jdk.io.permissionsUseCanonicalPath=false
13261326
#
13271327
# jdk.tls.alpnCharset=UTF-8
13281328
jdk.tls.alpnCharset=ISO_8859_1
1329+
1330+
#
1331+
# JNDI Object Factories Filter
1332+
#
1333+
# This filter is used by the JNDI runtime to control the set of object factory classes
1334+
# which will be allowed to instantiate objects from object references returned by
1335+
# naming/directory systems. The factory class named by the reference instance will be
1336+
# matched against this filter. The filter property supports pattern-based filter syntax
1337+
# with the same format as jdk.serialFilter.
1338+
#
1339+
# Each pattern is matched against the factory class name to allow or disallow it's
1340+
# instantiation. The access to a factory class is allowed unless the filter returns
1341+
# REJECTED.
1342+
#
1343+
# Note: This property is currently used by the JDK Reference implementation.
1344+
# It is not guaranteed to be examined and used by other implementations.
1345+
#
1346+
# If the system property jdk.jndi.object.factoriesFilter is also specified, it supersedes
1347+
# the security property value defined here. The default value of the property is "*".
1348+
#
1349+
# The default pattern value allows any object factory class specified by the reference
1350+
# instance to recreate the referenced object.
1351+
#jdk.jndi.object.factoriesFilter=*

src/java.naming/share/classes/com/sun/jndi/ldap/Obj.java

Lines changed: 4 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
/*
2-
* Copyright (c) 1999, 2011, Oracle and/or its affiliates. All rights reserved.
2+
* Copyright (c) 1999, 2020, Oracle and/or its affiliates. All rights reserved.
33
* DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
44
*
55
* This code is free software; you can redistribute it and/or modify it
@@ -233,6 +233,9 @@ static Object decodeObject(Attributes attrs)
233233
String[] codebases = getCodebases(attrs.get(JAVA_ATTRIBUTES[CODEBASE]));
234234
try {
235235
if ((attr = attrs.get(JAVA_ATTRIBUTES[SERIALIZED_DATA])) != null) {
236+
if (!VersionHelper.isSerialDataAllowed()) {
237+
throw new NamingException("Object deserialization is not allowed");
238+
}
236239
ClassLoader cl = helper.getURLClassLoader(codebases);
237240
return deserializeObject((byte[])attr.get(), cl);
238241
} else if ((attr = attrs.get(JAVA_ATTRIBUTES[REMOTE_LOC])) != null) {

src/java.naming/share/classes/com/sun/jndi/ldap/VersionHelper.java

Lines changed: 36 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
/*
2-
* Copyright (c) 1999, 2018, Oracle and/or its affiliates. All rights reserved.
2+
* Copyright (c) 1999, 2020, Oracle and/or its affiliates. All rights reserved.
33
* DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
44
*
55
* This code is free software; you can redistribute it and/or modify it
@@ -43,21 +43,52 @@ public final class VersionHelper {
4343
*/
4444
private static final boolean trustURLCodebase;
4545

46+
/**
47+
* Determines whether objects may be deserialized from the content of
48+
* 'javaSerializedData' attribute.
49+
*/
50+
private static final boolean trustSerialData;
51+
4652
static {
4753
// System property to control whether classes may be loaded from an
4854
// arbitrary URL code base
49-
PrivilegedAction<String> act =
50-
() -> System.getProperty("com.sun.jndi.ldap.object.trustURLCodebase", "false");
51-
String trust = AccessController.doPrivileged(act);
55+
String trust = getPrivilegedProperty(
56+
"com.sun.jndi.ldap.object.trustURLCodebase", "false");
5257
trustURLCodebase = "true".equalsIgnoreCase(trust);
58+
59+
// System property to control whether classes is allowed to be loaded from
60+
// 'javaSerializedData' attribute
61+
String trustSerialDataSp = getPrivilegedProperty(
62+
"com.sun.jndi.ldap.object.trustSerialData", "true");
63+
trustSerialData = "true".equalsIgnoreCase(trustSerialDataSp);
5364
}
5465

55-
private VersionHelper() { }
66+
private static String getPrivilegedProperty(String propertyName, String defaultVal) {
67+
PrivilegedAction<String> action = () -> System.getProperty(propertyName, defaultVal);
68+
if (System.getSecurityManager() == null) {
69+
return action.run();
70+
} else {
71+
return AccessController.doPrivileged(action);
72+
}
73+
}
74+
75+
private VersionHelper() {
76+
}
5677

5778
static VersionHelper getVersionHelper() {
5879
return helper;
5980
}
6081

82+
/**
83+
* Returns true if deserialization of objects from 'javaSerializedData'
84+
* LDAP attribute is allowed.
85+
*
86+
* @return true if deserialization is allowed; false - otherwise
87+
*/
88+
public static boolean isSerialDataAllowed() {
89+
return trustSerialData;
90+
}
91+
6192
ClassLoader getURLClassLoader(String[] url) throws MalformedURLException {
6293
ClassLoader parent = getContextClassLoader();
6394
/*
Lines changed: 114 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,114 @@
1+
/*
2+
* Copyright (c) 2020, Oracle and/or its affiliates. All rights reserved.
3+
* DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
4+
*
5+
* This code is free software; you can redistribute it and/or modify it
6+
* under the terms of the GNU General Public License version 2 only, as
7+
* published by the Free Software Foundation. Oracle designates this
8+
* particular file as subject to the "Classpath" exception as provided
9+
* by Oracle in the LICENSE file that accompanied this code.
10+
*
11+
* This code is distributed in the hope that it will be useful, but WITHOUT
12+
* ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
13+
* FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
14+
* version 2 for more details (a copy is included in the LICENSE file that
15+
* accompanied this code).
16+
*
17+
* You should have received a copy of the GNU General Public License version
18+
* 2 along with this work; if not, write to the Free Software Foundation,
19+
* Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
20+
*
21+
* Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
22+
* or visit www.oracle.com if you need additional information or have any
23+
* questions.
24+
*/
25+
26+
package com.sun.naming.internal;
27+
28+
import sun.security.util.SecurityProperties;
29+
30+
import javax.naming.Reference;
31+
import java.io.ObjectInputFilter;
32+
import java.io.ObjectInputFilter.FilterInfo;
33+
import java.io.ObjectInputFilter.Status;
34+
35+
/**
36+
* This class implements the filter that validates object factories classes instantiated
37+
* during {@link Reference} lookups.
38+
* There is one system-wide filter instance per VM that can be set via
39+
* the {@code "jdk.jndi.object.factoriesFilter"} system property value, or via
40+
* setting the property in the security properties file. The system property value supersedes
41+
* the security property value. If none of the properties are specified the default
42+
* "*" value is used.
43+
* The filter is implemented as {@link ObjectInputFilter} with capabilities limited to the
44+
* validation of a factory's class types only ({@linkplain FilterInfo#serialClass()}).
45+
* Array length, number of object references, depth, and stream size filtering capabilities are
46+
* not supported by the filter.
47+
*/
48+
public final class ObjectFactoriesFilter {
49+
50+
/**
51+
* Checks if serial filter configured with {@code "jdk.jndi.object.factoriesFilter"}
52+
* system property value allows instantiation of the specified objects factory class.
53+
* If the filter result is not {@linkplain Status#REJECTED REJECTED}, the filter will
54+
* allow the instantiation of objects factory class.
55+
*
56+
* @param factoryClass objects factory class
57+
* @return true - if the factory is allowed to be instantiated; false - otherwise
58+
*/
59+
public static boolean canInstantiateObjectsFactory(Class<?> factoryClass) {
60+
return checkInput(() -> factoryClass);
61+
}
62+
63+
private static boolean checkInput(FactoryInfo factoryInfo) {
64+
Status result = GLOBAL.checkInput(factoryInfo);
65+
return result != Status.REJECTED;
66+
}
67+
68+
// FilterInfo to check if objects factory class is allowed by the system-wide
69+
// filter. Array length, number of object references, depth, and stream size
70+
// capabilities are ignored.
71+
@FunctionalInterface
72+
private interface FactoryInfo extends FilterInfo {
73+
@Override
74+
default long arrayLength() {
75+
return -1;
76+
}
77+
78+
@Override
79+
default long depth() {
80+
return 1;
81+
}
82+
83+
@Override
84+
default long references() {
85+
return 0;
86+
}
87+
88+
@Override
89+
default long streamBytes() {
90+
return 0;
91+
}
92+
}
93+
94+
// Prevent instantiation of the factories filter class
95+
private ObjectFactoriesFilter() {
96+
throw new InternalError("Not instantiable");
97+
}
98+
99+
// System property name that contains the patterns to filter object factory names
100+
private static final String FACTORIES_FILTER_PROPNAME = "jdk.jndi.object.factoriesFilter";
101+
102+
// Default system property value that allows the load of any object factory classes
103+
private static final String DEFAULT_SP_VALUE = "*";
104+
105+
// System wide object factories filter constructed from the system property
106+
private static final ObjectInputFilter GLOBAL =
107+
ObjectInputFilter.Config.createFilter(getFilterPropertyValue());
108+
109+
// Get security or system property value
110+
private static String getFilterPropertyValue() {
111+
String propVal = SecurityProperties.privilegedGetOverridable(FACTORIES_FILTER_PROPNAME);
112+
return propVal != null ? propVal : DEFAULT_SP_VALUE;
113+
}
114+
}

src/java.naming/share/classes/com/sun/naming/internal/VersionHelper.java

Lines changed: 11 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -96,6 +96,10 @@ public Class<?> loadClass(String className) throws ClassNotFoundException {
9696
return loadClass(className, getContextClassLoader());
9797
}
9898

99+
public Class<?> loadClassWithoutInit(String className) throws ClassNotFoundException {
100+
return loadClass(className, false, getContextClassLoader());
101+
}
102+
99103
/**
100104
* @param className A non-null fully qualified class name.
101105
* @param codebase A non-null, space-separated list of URL strings.
@@ -118,12 +122,17 @@ public Class<?> loadClass(String className, String codebase)
118122
* This internal method is used with Thread Context Class Loader (TCCL),
119123
* please don't expose this method as public.
120124
*/
121-
Class<?> loadClass(String className, ClassLoader cl)
125+
Class<?> loadClass(String className, boolean initialize, ClassLoader cl)
122126
throws ClassNotFoundException {
123-
Class<?> cls = Class.forName(className, true, cl);
127+
Class<?> cls = Class.forName(className, initialize, cl);
124128
return cls;
125129
}
126130

131+
Class<?> loadClass(String className, ClassLoader cl)
132+
throws ClassNotFoundException {
133+
return loadClass(className, true, cl);
134+
}
135+
127136
/*
128137
* Returns a JNDI property from the system properties. Returns
129138
* null if the property is not set, or if there is no permission

src/java.naming/share/classes/javax/naming/spi/NamingManager.java

Lines changed: 12 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -31,6 +31,8 @@
3131
import java.util.*;
3232

3333
import javax.naming.*;
34+
35+
import com.sun.naming.internal.ObjectFactoriesFilter;
3436
import com.sun.naming.internal.VersionHelper;
3537
import com.sun.naming.internal.ResourceManager;
3638
import com.sun.naming.internal.FactoryEnumeration;
@@ -147,7 +149,11 @@ static ObjectFactory getObjectFactoryFromReference(
147149

148150
// Try to use current class loader
149151
try {
150-
clas = helper.loadClass(factoryName);
152+
clas = helper.loadClassWithoutInit(factoryName);
153+
// Validate factory's class with the objects factory serial filter
154+
if (!ObjectFactoriesFilter.canInstantiateObjectsFactory(clas)) {
155+
return null;
156+
}
151157
} catch (ClassNotFoundException e) {
152158
// ignore and continue
153159
// e.printStackTrace();
@@ -160,6 +166,11 @@ static ObjectFactory getObjectFactoryFromReference(
160166
(codebase = ref.getFactoryClassLocation()) != null) {
161167
try {
162168
clas = helper.loadClass(factoryName, codebase);
169+
// Validate factory's class with the objects factory serial filter
170+
if (clas == null ||
171+
!ObjectFactoriesFilter.canInstantiateObjectsFactory(clas)) {
172+
return null;
173+
}
163174
} catch (ClassNotFoundException e) {
164175
}
165176
}

src/java.naming/share/classes/module-info.java

Lines changed: 32 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -29,11 +29,11 @@
2929
* Common standard JNDI environment properties that may be supported
3030
* by JNDI providers are defined and documented in
3131
* {@link javax.naming.Context}. Specific JNDI provider implementations
32-
* may also support other environment properties, which are specific
32+
* may also support other environment or system properties, which are specific
3333
* to their implementation.
3434
*
3535
* @implNote
36-
* The following implementation specific properties are supported by the
36+
* The following implementation specific environment properties are supported by the
3737
* default LDAP Naming Service Provider implementation in the JDK:
3838
* <ul>
3939
* <li>{@code com.sun.jndi.ldap.connect.timeout}:
@@ -74,7 +74,36 @@
7474
* channel binding information to the server.
7575
* </li>
7676
* </ul>
77-
*
77+
* <p>The following implementation specific system properties are supported by the
78+
* default LDAP Naming Service Provider implementation in the JDK:
79+
* <ul>
80+
* <li>{@systemProperty com.sun.jndi.ldap.object.trustSerialData}:
81+
* <br>The value of this system property is the string representation of a boolean value
82+
* which allows to control the deserialization of java objects from the 'javaSerializedData'
83+
* LDAP attribute. To prevent the deserialization of java objects from the 'javaSerializedData'
84+
* attribute, the system property value can be set to 'false'.
85+
* <br>If the property is not specified then the deserialization of java objects
86+
* from the 'javaSerializedData' attribute is allowed.
87+
* </li>
88+
* <li>{@systemProperty jdk.jndi.object.factoriesFilter}:
89+
* <br>The value of this system property defines a filter used by
90+
* the JNDI runtime implementation to control the set of object factory classes which will
91+
* be allowed to instantiate objects from object references returned by naming/directory systems.
92+
* The factory class named by the reference instance will be matched against this filter.
93+
* The filter property supports pattern-based filter syntax with the same format as
94+
* {@link java.io.ObjectInputFilter.Config#createFilter(String) jdk.serialFilter}.
95+
* This property can also be specified as a {@linkplain java.security.Security security property}.
96+
* This property is also supported by the <a href="{@docRoot}/jdk.naming.rmi/module-summary.html">default JNDI
97+
* RMI Provider</a>.
98+
* <br>The default value allows any object factory class specified by the reference
99+
* instance to recreate the referenced object.
100+
* </li>
101+
* </ul>
102+
* <p>Other providers may define additional properties in their module description:
103+
* <ul>
104+
* <li><a href="{@docRoot}/jdk.naming.dns/module-summary.html">DNS Naming Provider</a></li>
105+
* <li><a href="{@docRoot}/jdk.naming.rmi/module-summary.html">RMI Naming Provider</a></li>
106+
* </ul>
78107
* @provides javax.naming.ldap.spi.LdapDnsProvider
79108
*
80109
* @uses javax.naming.ldap.spi.LdapDnsProvider

src/jdk.naming.rmi/share/classes/module-info.java

Lines changed: 19 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
/*
2-
* Copyright (c) 2014, 2015, Oracle and/or its affiliates. All rights reserved.
2+
* Copyright (c) 2014, 2020, Oracle and/or its affiliates. All rights reserved.
33
* DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
44
*
55
* This code is free software; you can redistribute it and/or modify it
@@ -26,6 +26,24 @@
2626
/**
2727
* Provides the implementation of the RMI Java Naming provider.
2828
*
29+
* @implNote
30+
* The following implementation specific system properties are supported by the
31+
* default RMI Naming Service Provider implementation in the JDK:
32+
* <ul>
33+
* <li>{@systemProperty jdk.jndi.object.factoriesFilter}:
34+
* <br>The value of this system property defines a filter used by
35+
* the JNDI runtime implementation to control the set of object factory classes which will
36+
* be allowed to instantiate objects from object references returned by naming/directory systems.
37+
* The factory class named by the reference instance will be matched against this filter.
38+
* The filter property supports pattern-based filter syntax with the same format as
39+
* {@link java.io.ObjectInputFilter.Config#createFilter(String) jdk.serialFilter}.
40+
* This property can also be specified as a {@linkplain java.security.Security security property}.
41+
* This property is also supported by the <a href="{@docRoot}/java.naming/module-summary.html">default
42+
* LDAP Naming Service Provider</a>.
43+
* <br>The default value allows any object factory class specified by the reference
44+
* instance to recreate the referenced object.
45+
* </li>
46+
* </ul>
2947
* @provides javax.naming.spi.InitialContextFactory
3048
* @moduleGraph
3149
* @since 9

0 commit comments

Comments
 (0)