Java: Add support for FastJson in unsafe deserialization. #4427
There are no files selected for viewing
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,3 @@ | ||
| lgtm,codescanning | ||
| * The "Deserialization of user-controlled data" (`java/unsafe-deserialization`) query | ||
| now recognizes `FastJson` deserialization. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,46 @@ | ||
| /** | ||
| * Provides classes and predicates for working with the FastJson framework. | ||
| */ | ||
|
|
||
| import java | ||
|
|
||
| /** | ||
| * The class `com.alibaba.fastjson.JSON`. | ||
| */ | ||
| class FastJson extends RefType { | ||
| FastJson() { this.hasQualifiedName("com.alibaba.fastjson", "JSON") } | ||
| } | ||
|
|
||
| /** | ||
| * A FastJson parse method. This is either `JSON.parse` or `JSON.parseObject`. | ||
| */ | ||
| class FastJsonParseMethod extends Method { | ||
| FastJsonParseMethod() { | ||
| this.getDeclaringType() instanceof FastJson and | ||
| this.hasName(["parse", "parseObject"]) | ||
| } | ||
| } | ||
|
|
||
| /** | ||
| * A call to `ParserConfig.setSafeMode`. | ||
| */ | ||
| class FastJsonSetSafeMode extends MethodAccess { | ||
| FastJsonSetSafeMode() { | ||
| exists(Method m | | ||
| this.getMethod() = m and | ||
| m.hasName("setSafeMode") and | ||
| m.getDeclaringType().hasQualifiedName("com.alibaba.fastjson.parser", "ParserConfig") | ||
|
There was a problem hiding this comment. I would add There was a problem hiding this comment. I don't think that's necessary here. I think it's quite unlikely that this will be overridden. |
||
| ) | ||
| } | ||
|
|
||
| /** Gets the constant value passed to this call, if any. */ | ||
| boolean getMode() { result = this.getArgument(0).(CompileTimeConstantExpr).getBooleanValue() } | ||
| } | ||
|
|
||
| /** | ||
| * Holds if there is some call to `ParserConfig.setSafeMode` that does not | ||
| * explicitly disable safe mode. | ||
| */ | ||
| predicate fastJsonLooksSafe() { | ||
| exists(FastJsonSetSafeMode setsafe | not setsafe.getMode() = false) | ||
| } | ||
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,33 @@ | ||
| import java.io.*; | ||
| import java.net.Socket; | ||
| import com.alibaba.fastjson.JSON; | ||
|
|
||
| public class B { | ||
| public Object deserializeJson1(Socket sock) { | ||
| InputStream inputStream = sock.getInputStream(); | ||
| return JSON.parseObject(inputStream, null); // unsafe | ||
| } | ||
|
|
||
| public Object deserializeJson2(Socket sock) { | ||
| InputStream inputStream = sock.getInputStream(); | ||
| byte[] bytes = new byte[100]; | ||
| inputStream.read(bytes); | ||
| return JSON.parse(bytes); // unsafe | ||
| } | ||
|
|
||
| public Object deserializeJson3(Socket sock) { | ||
| InputStream inputStream = sock.getInputStream(); | ||
| byte[] bytes = new byte[100]; | ||
| inputStream.read(bytes); | ||
| String s = new String(bytes); | ||
| return JSON.parseObject(s); // unsafe | ||
| } | ||
|
|
||
| public Object deserializeJson4(Socket sock) { | ||
| InputStream inputStream = sock.getInputStream(); | ||
| byte[] bytes = new byte[100]; | ||
| inputStream.read(bytes); | ||
| String s = new String(bytes); | ||
| return JSON.parse(s); // unsafe | ||
| } | ||
| } |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -1 +1 @@ | ||
| //semmle-extractor-options: --javac-args -cp ${testdir}/../../../stubs/snakeyaml-1.21:${testdir}/../../../stubs/xstream-1.4.10:${testdir}/../../../stubs/kryo-4.0.2:${testdir}/../../../stubs/jsr311-api-1.1.1:${testdir}/../../../stubs/fastjson-1.2.74 |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,210 @@ | ||
| /* | ||
| * Copyright 1999-2017 Alibaba Group. | ||
| * | ||
| * Licensed under the Apache License, Version 2.0 (the "License"); | ||
| * you may not use this file except in compliance with the License. | ||
| * You may obtain a copy of the License at | ||
| * | ||
| * http://www.apache.org/licenses/LICENSE-2.0 | ||
| * | ||
| * Unless required by applicable law or agreed to in writing, software | ||
| * distributed under the License is distributed on an "AS IS" BASIS, | ||
| * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. | ||
| * See the License for the specific language governing permissions and | ||
| * limitations under the License. | ||
| */ | ||
| package com.alibaba.fastjson; | ||
|
|
||
| import java.io.IOException; | ||
| import java.io.InputStream; | ||
| import java.lang.reflect.Type; | ||
| import java.nio.charset.Charset; | ||
| import java.nio.charset.CharsetDecoder; | ||
| import java.util.*; | ||
|
|
||
| import com.alibaba.fastjson.parser.*; | ||
| import com.alibaba.fastjson.parser.deserializer.ParseProcess; | ||
|
|
||
| public abstract class JSON { | ||
| public static Object parse(String text) { | ||
| return null; | ||
| } | ||
|
|
||
| public static Object parse(String text, ParserConfig config) { | ||
| return null; | ||
| } | ||
|
|
||
| public static Object parse(String text, ParserConfig config, Feature... features) { | ||
| return null; | ||
| } | ||
|
|
||
| public static Object parse(String text, ParserConfig config, int features) { | ||
| return null; | ||
| } | ||
|
|
||
| public static Object parse(String text, int features) { | ||
| return null; | ||
| } | ||
|
|
||
| public static Object parse(byte[] input, Feature... features) { | ||
| return null; | ||
| } | ||
|
|
||
| public static Object parse(byte[] input, int off, int len, CharsetDecoder charsetDecoder, Feature... features) { | ||
| return null; | ||
| } | ||
|
|
||
| public static Object parse(byte[] input, int off, int len, CharsetDecoder charsetDecoder, int features) { | ||
| return null; | ||
| } | ||
|
|
||
| public static Object parse(String text, Feature... features) { | ||
| return null; | ||
| } | ||
|
|
||
| public static JSONObject parseObject(String text, Feature... features) { | ||
| return null; | ||
| } | ||
|
|
||
| public static JSONObject parseObject(String text) { | ||
| return null; | ||
| } | ||
|
|
||
| public static <T> T parseObject(String text, TypeReference<T> type, Feature... features) { | ||
| return null; | ||
| } | ||
|
|
||
| public static <T> T parseObject(String json, Class<T> clazz, Feature... features) { | ||
| return null; | ||
| } | ||
|
|
||
| public static <T> T parseObject(String text, Class<T> clazz, ParseProcess processor, Feature... features) { | ||
| return null; | ||
| } | ||
|
|
||
| public static <T> T parseObject(String json, Type type, Feature... features) { | ||
| return null; | ||
| } | ||
|
|
||
| public static <T> T parseObject(String input, Type clazz, ParseProcess processor, Feature... features) { | ||
| return null; | ||
| } | ||
|
|
||
| public static <T> T parseObject(String input, Type clazz, int featureValues, Feature... features) { | ||
| return null; | ||
| } | ||
|
|
||
| public static <T> T parseObject(String input, Type clazz, ParserConfig config, Feature... features) { | ||
| return null; | ||
| } | ||
|
|
||
| public static <T> T parseObject(String input, Type clazz, ParserConfig config, int featureValues, | ||
| Feature... features) { | ||
| return null; | ||
| } | ||
|
|
||
| public static <T> T parseObject(String input, Type clazz, ParserConfig config, ParseProcess processor, | ||
| int featureValues, Feature... features) { | ||
| return null; | ||
| } | ||
|
|
||
| public static <T> T parseObject(byte[] bytes, Type clazz, Feature... features) { | ||
| return null; | ||
| } | ||
|
|
||
| public static <T> T parseObject(byte[] bytes, int offset, int len, Charset charset, Type clazz, Feature... features) { | ||
| return null; | ||
| } | ||
|
|
||
| public static <T> T parseObject(byte[] bytes, | ||
| Charset charset, | ||
| Type clazz, | ||
| ParserConfig config, | ||
| ParseProcess processor, | ||
| int featureValues, | ||
| Feature... features) { | ||
| return null; | ||
| } | ||
|
|
||
| public static <T> T parseObject(byte[] bytes, int offset, int len, | ||
| Charset charset, | ||
| Type clazz, | ||
| ParserConfig config, | ||
| ParseProcess processor, | ||
| int featureValues, | ||
| Feature... features) { | ||
| return null; | ||
| } | ||
|
|
||
| public static <T> T parseObject(byte[] input, | ||
| int off, | ||
| int len, | ||
| CharsetDecoder charsetDecoder, | ||
| Type clazz, | ||
| Feature... features) { | ||
| return null; | ||
| } | ||
|
|
||
| public static <T> T parseObject(char[] input, int length, Type clazz, Feature... features) { | ||
| return null; | ||
| } | ||
|
|
||
| public static <T> T parseObject(InputStream is, | ||
| Type type, | ||
| Feature... features) throws IOException { | ||
| return null; | ||
| } | ||
|
|
||
| public static <T> T parseObject(InputStream is, | ||
| Charset charset, | ||
| Type type, | ||
| Feature... features) throws IOException { | ||
| return null; | ||
| } | ||
|
|
||
| public static <T> T parseObject(InputStream is, | ||
| Charset charset, | ||
| Type type, | ||
| ParserConfig config, | ||
| Feature... features) throws IOException { | ||
| return null; | ||
| } | ||
|
|
||
| public static <T> T parseObject(InputStream is, | ||
| Charset charset, | ||
| Type type, | ||
| ParserConfig config, | ||
| ParseProcess processor, | ||
| int featureValues, | ||
| Feature... features) throws IOException { | ||
| return null; | ||
| } | ||
|
|
||
| public static <T> T parseObject(String text, Class<T> clazz) { | ||
| return null; | ||
| } | ||
|
|
||
| public static JSONArray parseArray(String text) { | ||
| return null; | ||
| } | ||
|
|
||
| public static JSONArray parseArray(String text, ParserConfig parserConfig) { | ||
| return null; | ||
| } | ||
|
|
||
| public static <T> List<T> parseArray(String text, Class<T> clazz) { | ||
| return null; | ||
| } | ||
|
|
||
| public static <T> List<T> parseArray(String text, Class<T> clazz, ParserConfig config) { | ||
| return null; | ||
| } | ||
|
|
||
| public static List<Object> parseArray(String text, Type[] types) { | ||
| return null; | ||
| } | ||
|
|
||
| public static List<Object> parseArray(String text, Type[] types, ParserConfig config) { | ||
| return null; | ||
| } | ||
| } |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,19 @@ | ||
| /* | ||
| * Copyright 1999-2017 Alibaba Group. | ||
| * | ||
| * Licensed under the Apache License, Version 2.0 (the "License"); | ||
| * you may not use this file except in compliance with the License. | ||
| * You may obtain a copy of the License at | ||
| * | ||
| * http://www.apache.org/licenses/LICENSE-2.0 | ||
| * | ||
| * Unless required by applicable law or agreed to in writing, software | ||
| * distributed under the License is distributed on an "AS IS" BASIS, | ||
| * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. | ||
| * See the License for the specific language governing permissions and | ||
| * limitations under the License. | ||
| */ | ||
| package com.alibaba.fastjson; | ||
|
|
||
| public class JSONArray extends JSON { | ||
| } |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,19 @@ | ||
| /* | ||
| * Copyright 1999-2017 Alibaba Group. | ||
| * | ||
| * Licensed under the Apache License, Version 2.0 (the "License"); | ||
| * you may not use this file except in compliance with the License. | ||
| * You may obtain a copy of the License at | ||
| * | ||
| * http://www.apache.org/licenses/LICENSE-2.0 | ||
| * | ||
| * Unless required by applicable law or agreed to in writing, software | ||
| * distributed under the License is distributed on an "AS IS" BASIS, | ||
| * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. | ||
| * See the License for the specific language governing permissions and | ||
| * limitations under the License. | ||
| */ | ||
| package com.alibaba.fastjson; | ||
|
|
||
| public class JSONObject extends JSON { | ||
| } |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,4 @@ | ||
| package com.alibaba.fastjson; | ||
|
|
||
| public class TypeReference<T> { | ||
| } |
Oops, something went wrong.
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Turns out that these are static methods.