-
Notifications
You must be signed in to change notification settings - Fork 1.1k
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
Restrict classes allowed for cluster config and event types (#18165)
Add a new safe_classes configuration option to restrict the classes allowed to be used
as cluster config and event types.
The configuration option allows to specify a comma-separated set of prefixes matched
against the fully qualified class name.
For now, the default value for the configuration is org.graylog.,org.graylog2., which will
allow all classes that Graylog maintains.
This should work out of the box for almost all setups. Changing the default value might
only be necessary if external plugins require cluster config or event types outside the
"org.graylog." or "org.graylog2." namespaces. If that is the case, the configuration setting
can be adjusted to cover this use case, e.b. by setting it to
safe_classes = org.graylog.,org.graylog2.,custom.plugin.namespace.
if said classes are located within the custom.plugin.namespace package.
Refs: GHSA-p6gg-5hf4-4rgj- Loading branch information
Showing
16 changed files
with
426 additions
and
29 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,4 @@ | ||
| type = "security" | ||
| message = "Restrict classes allowed for cluster config and event types. [GHSA-p6gg-5hf4-4rgj](https://github.com/Graylog2/graylog2-server/security/advisories/GHSA-p6gg-5hf4-4rgj)" | ||
|
|
||
| pulls = ["18165"] |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
60 changes: 60 additions & 0 deletions
60
graylog2-server/src/main/java/org/graylog2/security/RestrictedChainingClassLoader.java
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,60 @@ | ||
| /* | ||
| * Copyright (C) 2020 Graylog, Inc. | ||
| * | ||
| * This program is free software: you can redistribute it and/or modify | ||
| * it under the terms of the Server Side Public License, version 1, | ||
| * as published by MongoDB, Inc. | ||
| * | ||
| * This program is distributed in the hope that it will be useful, | ||
| * but WITHOUT ANY WARRANTY; without even the implied warranty of | ||
| * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the | ||
| * Server Side Public License for more details. | ||
| * | ||
| * You should have received a copy of the Server Side Public License | ||
| * along with this program. If not, see | ||
| * <http://www.mongodb.com/licensing/server-side-public-license>. | ||
| */ | ||
| package org.graylog2.security; | ||
|
|
||
| import jakarta.inject.Inject; | ||
| import org.graylog2.Configuration; | ||
| import org.graylog2.shared.plugins.ChainingClassLoader; | ||
|
|
||
| import static org.graylog2.shared.utilities.StringUtils.f; | ||
|
|
||
| /** | ||
| * A wrapper around the chaining class loader intended only for loading classes safely by considering an allow-list of | ||
| * class name prefixes. | ||
| */ | ||
| public class RestrictedChainingClassLoader { | ||
| private final ChainingClassLoader delegate; | ||
| private final SafeClasses safeClasses; | ||
|
|
||
| @Inject | ||
| public RestrictedChainingClassLoader(ChainingClassLoader delegate, SafeClasses safeClasses) { | ||
| this.delegate = delegate; | ||
| this.safeClasses = safeClasses; | ||
| } | ||
|
|
||
| /** | ||
| * Load the class only if the name passes the check of {@link SafeClasses#isSafeToLoad(String)}. If the class name | ||
| * passes the check, the call is delegated to {@link ChainingClassLoader#loadClass(String)}. If it doesn't pass the | ||
| * check, an {@link UnsafeClassLoadingAttemptException} is thrown. | ||
| * | ||
| * @return class as returned by the delegated call to {@link ChainingClassLoader#loadClass(String)} | ||
| * @throws ClassNotFoundException if the class was not found | ||
| * @throws UnsafeClassLoadingAttemptException if the class name didn't pass the safety check of | ||
| * {@link SafeClasses#isSafeToLoad(String)} | ||
| */ | ||
| public Class<?> loadClassSafely(String name) throws ClassNotFoundException, UnsafeClassLoadingAttemptException { | ||
| if (safeClasses.isSafeToLoad(name)) { | ||
| return delegate.loadClass(name); | ||
| } else { | ||
| throw new UnsafeClassLoadingAttemptException( | ||
| f("Prevented loading of unsafe class \"%s\". Consider adjusting the configuration setting " + | ||
| "\"%s\", if you think that this is a mistake.", name, Configuration.SAFE_CLASSES) | ||
| ); | ||
| } | ||
| } | ||
|
|
||
| } |
Oops, something went wrong.