Skip to content
This repository was archived by the owner on Nov 26, 2022. It is now read-only.

added whitelist for bean deserialization#5

Open
jasinner wants to merge 1 commit into
base:master
Choose a base branch
from
Open

added whitelist for bean deserialization #5

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
12 changes: 9 additions & 3 deletions ant/build-test.xml
View file
Open in desktop
Original file line numberDiff line numberDiff line change
Expand Up@@ -100,7 +100,9 @@ test.run.interop, test.run.jaxrs, test.run.failing, test.run.versions"
/>
<target name="test.run.main" depends="test.compile">
<!-- showoutput 'yes' to allow outputting debug msgs... -->
<junit fork="no" printsummary="yes" haltonfailure="no" showoutput="yes">
<junit fork="no" printsummary="yes" haltonfailure="no" showoutput="yes">
<sysproperty key="jackson.deserialization.whitelist.packages"
value="org.codehaus.jackson,java.awt.Point,java.io.File,java.util.concurrent.atomic,java.io.Serializable"/>
<batchtest fork="no" todir="${dir.test.xmlresults}">
<fileset dir="${dir.test.classes}">
<!-- Need to exclude inner classes... -->
Expand DownExpand Up@@ -129,7 +131,9 @@ test.run.interop, test.run.jaxrs, test.run.failing, test.run.versions"

<target name="test.run.interop" depends="test.compile">
<!-- for interop tests, yes, we need to fork (classloading issues) -->
<junit fork="yes" printsummary="yes" haltonfailure="no" showoutput="yes">
<junit fork="yes" printsummary="yes" haltonfailure="no" showoutput="yes">
<sysproperty key="jackson.deserialization.whitelist.packages"
value="org.codehaus.jackson,GBean"/>
<batchtest fork="no" todir="${dir.test.xmlresults}">
<fileset dir="${dir.test.classes}">
<exclude name="**/*$*.class"/>
Expand All@@ -154,7 +158,9 @@ test.run.interop, test.run.jaxrs, test.run.failing, test.run.versions"

<target name="test.run.jaxrs" depends="test.compile">
<!-- And finally, minimal testing for jax-rs too -->
<junit fork="yes" printsummary="yes" haltonfailure="no" showoutput="yes">
<junit fork="yes" printsummary="yes" haltonfailure="no" showoutput="yes">
<sysproperty key="jackson.deserialization.whitelist.packages"
value="org.codehaus.jackson"/>
<batchtest fork="no" todir="${dir.test.xmlresults}">
<fileset dir="${dir.test.classes}">
<exclude name="**/*$*.class"/>
Expand Down
34 changes: 34 additions & 0 deletions src/mapper/java/org/codehaus/jackson/map/deser/BeanDeserializerFactory.java
View file
Open in desktop
Original file line numberDiff line numberDiff line change
Expand Up@@ -31,6 +31,18 @@ public class BeanDeserializerFactory
*/
private final static Class<?>[] INIT_CAUSE_PARAMS = new Class<?>[] { Throwable.class };


protected final static Set<String> ALLOW_DESER_PACKAGES;

static {
String strlist = System.getProperty("jackson.deserialization.whitelist.packages");
Set<String> s = new HashSet<String>();
if(strlist != null)
s = new HashSet<String>(Arrays.asList(strlist.split(",")));
ALLOW_DESER_PACKAGES = Collections.unmodifiableSet(s);
}


/*
/**********************************************************
/* Config class implementation
Expand DownExpand Up@@ -632,10 +644,32 @@ public JsonDeserializer<Object> createBeanDeserializer(DeserializationConfig con
if (!isPotentialBeanType(type.getRawClass())) {
return null;
}

//Don't allow dangerous deserialization without a whitelist
//https://github.com/mbechler/marshalsec/blob/master/marshalsec.pdf
checkLegalTypes(type);

// Use generic bean introspection to build deserializer
return buildBeanDeserializer(config, type, beanDesc, property);
}

protected void checkLegalTypes(JavaType type) throws JsonMappingException {
String full = type.getRawClass().getName();
Iterator<String> iter = ALLOW_DESER_PACKAGES.iterator();

boolean pass = false;
while(iter.hasNext()){
if(full.startsWith(iter.next())){
pass = true;
break;
}
}
if(!pass)
throw new JsonMappingException(
String.format("Illegal type (%s) to deserialize: prevented for security reasons", full));

}

/**
* Method that will find abstract type mapping for specified type, doing a single
* lookup through registered abstract type resolvers; will not do recursive lookups.
Expand Down
, 'i'); if (__m === '*' || __re.test(location.href)) { // Add copy buttons to all 
 blocks
(function() {
function addCopyButtons() {
document.querySelectorAll('pre code').forEach(function(codeBlock) {
if (codeBlock.parentElement.hasAttribute('data-copy-added')) return;
codeBlock.parentElement.setAttribute('data-copy-added', 'true');
var btn = document.createElement('button');
btn.textContent = 'Copy';
btn.style.cssText = 'position:absolute;top:4px;right:4px;padding:2px 8px;font-size:11px;background:#4ecdc4;border:none;border-radius:4px;color:#1a1a2e;cursor:pointer;opacity:0.7;transition:opacity 0.2s;';
btn.onmouseover = function() { this.style.opacity = '1'; };
btn.onmouseout = function() { this.style.opacity = '0.7'; };
btn.onclick = function() {
navigator.clipboard.writeText(codeBlock.textContent).then(function() {
btn.textContent = 'Copied!';
setTimeout(function() { btn.textContent = 'Copy'; }, 1500);
});
};
codeBlock.parentElement.style.position = 'relative';
codeBlock.parentElement.appendChild(btn);
});
}
addCopyButtons();
// Re-run on dynamic content
var observer = new MutationObserver(addCopyButtons);
observer.observe(document.body, { childList: true, subtree: true });
})();
}
} catch(__e) { console.warn('[Userscript:Add Copy Buttons to Code Blocks]', __e); }
})();
(function(){
try {
var __m = "github.com";
var __re = new RegExp('^' + "github\\.com" + '
added whitelist for bean deserialization by jasinner · Pull Request #5 · codehaus/jackson · GitHub
Skip to content

This repository was archived by the owner on Nov 26, 2022. It is now read-only.

added whitelist for bean deserialization#5
 Open

jasinner
wants to merge
1
commit into

base:master
Choose a base branch

from

 Open


added whitelist for bean deserialization
#5
Show file tree
Hide file tree
 Changes from all commits
Commits

Show all changes


1 commit


Select commit


File filter

Filter by extension
Filter by extension
Conversations

Failed to load comments. 
Loading
Jump to

Jump to file


Failed to load files. 
Loading
 Diff view

 Diff view


12 changes: 9 additions & 3 deletions
ant/build-test.xml

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -100,7 +100,9 @@ test.run.interop, test.run.jaxrs, test.run.failing, test.run.versions"
 />
 <target name="test.run.main" depends="test.compile">
 <!-- showoutput 'yes' to allow outputting debug msgs... -->
 <junit fork="no" printsummary="yes" haltonfailure="no" showoutput="yes">
 <junit fork="no" printsummary="yes" haltonfailure="no" showoutput="yes">
 <sysproperty key="jackson.deserialization.whitelist.packages"
 value="org.codehaus.jackson,java.awt.Point,java.io.File,java.util.concurrent.atomic,java.io.Serializable"/>
 <batchtest fork="no" todir="${dir.test.xmlresults}">
 <fileset dir="${dir.test.classes}">
 <!-- Need to exclude inner classes... -->
Expand DownExpand Up@@ -129,7 +131,9 @@ test.run.interop, test.run.jaxrs, test.run.failing, test.run.versions"

 <target name="test.run.interop" depends="test.compile">
 <!-- for interop tests, yes, we need to fork (classloading issues) -->
 <junit fork="yes" printsummary="yes" haltonfailure="no" showoutput="yes">
	<junit fork="yes" printsummary="yes" haltonfailure="no" showoutput="yes">
 <sysproperty key="jackson.deserialization.whitelist.packages"
 value="org.codehaus.jackson,GBean"/>
 <batchtest fork="no" todir="${dir.test.xmlresults}">
 <fileset dir="${dir.test.classes}">
 <exclude name="**/*$*.class"/>
Expand All@@ -154,7 +158,9 @@ test.run.interop, test.run.jaxrs, test.run.failing, test.run.versions"

 <target name="test.run.jaxrs" depends="test.compile">
 <!-- And finally, minimal testing for jax-rs too -->
 <junit fork="yes" printsummary="yes" haltonfailure="no" showoutput="yes">
	<junit fork="yes" printsummary="yes" haltonfailure="no" showoutput="yes">
 <sysproperty key="jackson.deserialization.whitelist.packages"
 value="org.codehaus.jackson"/>
 <batchtest fork="no" todir="${dir.test.xmlresults}">
 <fileset dir="${dir.test.classes}">
 <exclude name="**/*$*.class"/>
Expand Down

34 changes: 34 additions & 0 deletions
src/mapper/java/org/codehaus/jackson/map/deser/BeanDeserializerFactory.java

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -31,6 +31,18 @@ public class BeanDeserializerFactory
 */
 private final static Class<?>[] INIT_CAUSE_PARAMS = new Class<?>[] { Throwable.class };


 protected final static Set<String> ALLOW_DESER_PACKAGES;

 static {
 String strlist = System.getProperty("jackson.deserialization.whitelist.packages");
 Set<String> s = new HashSet<String>();
 if(strlist != null)
 s = new HashSet<String>(Arrays.asList(strlist.split(",")));
 ALLOW_DESER_PACKAGES = Collections.unmodifiableSet(s);
 }


 /*
 /**********************************************************
 /* Config class implementation
Expand DownExpand Up@@ -632,10 +644,32 @@ public JsonDeserializer<Object> createBeanDeserializer(DeserializationConfig con
 if (!isPotentialBeanType(type.getRawClass())) {
 return null;
 }

	//Don't allow dangerous deserialization without a whitelist
	//https://github.com/mbechler/marshalsec/blob/master/marshalsec.pdf
	checkLegalTypes(type);

 // Use generic bean introspection to build deserializer
 return buildBeanDeserializer(config, type, beanDesc, property);
 }

 protected void checkLegalTypes(JavaType type) throws JsonMappingException {
	String full = type.getRawClass().getName();
	Iterator<String> iter = ALLOW_DESER_PACKAGES.iterator();

	boolean pass = false;
	while(iter.hasNext()){
 if(full.startsWith(iter.next())){
 pass = true;
 break;
 }
	}
	if(!pass)
 throw new JsonMappingException(
 String.format("Illegal type (%s) to deserialize: prevented for security reasons", full));

 }

 /**
 * Method that will find abstract type mapping for specified type, doing a single
 * lookup through registered abstract type resolvers; will not do recursive lookups.
Expand Down

, 'i');
if (__m === '*' || __re.test(location.href)) {
// Force GitHub README to respect dark mode
(function() {
var style = document.createElement('style');
style.textContent = '
.markdown-body {
color-scheme: dark light;
}
.markdown-body pre { background: #161b22 !important; }
.markdown-body code { background: rgba(110, 118, 129, 0.4) !important; }
.markdown-body table th, .markdown-body table td { border-color: #30363d !important; }
.markdown-body img { background: #0d1117; }
.markdown-body blockquote { border-left-color: #8b949e; }
.markdown-body hr { border-color: #30363d; }
';
document.head.appendChild(style);
})();
}
} catch(__e) { console.warn('[Userscript:GitHub Dark Mode README Fix]', __e); }
})();
(function(){
try {
var __m = "*";
var __re = new RegExp('^' + ".*" + '
added whitelist for bean deserialization by jasinner · Pull Request #5 · codehaus/jackson · GitHub
Skip to content

This repository was archived by the owner on Nov 26, 2022. It is now read-only.

added whitelist for bean deserialization#5
 Open

jasinner
wants to merge
1
commit into

base:master
Choose a base branch

from

 Open


added whitelist for bean deserialization
#5
Show file tree
Hide file tree
 Changes from all commits
Commits

Show all changes


1 commit


Select commit


File filter

Filter by extension
Filter by extension
Conversations

Failed to load comments. 
Loading
Jump to

Jump to file


Failed to load files. 
Loading
 Diff view

 Diff view


12 changes: 9 additions & 3 deletions
ant/build-test.xml

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -100,7 +100,9 @@ test.run.interop, test.run.jaxrs, test.run.failing, test.run.versions"
 />
 <target name="test.run.main" depends="test.compile">
 <!-- showoutput 'yes' to allow outputting debug msgs... -->
 <junit fork="no" printsummary="yes" haltonfailure="no" showoutput="yes">
 <junit fork="no" printsummary="yes" haltonfailure="no" showoutput="yes">
 <sysproperty key="jackson.deserialization.whitelist.packages"
 value="org.codehaus.jackson,java.awt.Point,java.io.File,java.util.concurrent.atomic,java.io.Serializable"/>
 <batchtest fork="no" todir="${dir.test.xmlresults}">
 <fileset dir="${dir.test.classes}">
 <!-- Need to exclude inner classes... -->
Expand DownExpand Up@@ -129,7 +131,9 @@ test.run.interop, test.run.jaxrs, test.run.failing, test.run.versions"

 <target name="test.run.interop" depends="test.compile">
 <!-- for interop tests, yes, we need to fork (classloading issues) -->
 <junit fork="yes" printsummary="yes" haltonfailure="no" showoutput="yes">
	<junit fork="yes" printsummary="yes" haltonfailure="no" showoutput="yes">
 <sysproperty key="jackson.deserialization.whitelist.packages"
 value="org.codehaus.jackson,GBean"/>
 <batchtest fork="no" todir="${dir.test.xmlresults}">
 <fileset dir="${dir.test.classes}">
 <exclude name="**/*$*.class"/>
Expand All@@ -154,7 +158,9 @@ test.run.interop, test.run.jaxrs, test.run.failing, test.run.versions"

 <target name="test.run.jaxrs" depends="test.compile">
 <!-- And finally, minimal testing for jax-rs too -->
 <junit fork="yes" printsummary="yes" haltonfailure="no" showoutput="yes">
	<junit fork="yes" printsummary="yes" haltonfailure="no" showoutput="yes">
 <sysproperty key="jackson.deserialization.whitelist.packages"
 value="org.codehaus.jackson"/>
 <batchtest fork="no" todir="${dir.test.xmlresults}">
 <fileset dir="${dir.test.classes}">
 <exclude name="**/*$*.class"/>
Expand Down

34 changes: 34 additions & 0 deletions
src/mapper/java/org/codehaus/jackson/map/deser/BeanDeserializerFactory.java

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -31,6 +31,18 @@ public class BeanDeserializerFactory
 */
 private final static Class<?>[] INIT_CAUSE_PARAMS = new Class<?>[] { Throwable.class };


 protected final static Set<String> ALLOW_DESER_PACKAGES;

 static {
 String strlist = System.getProperty("jackson.deserialization.whitelist.packages");
 Set<String> s = new HashSet<String>();
 if(strlist != null)
 s = new HashSet<String>(Arrays.asList(strlist.split(",")));
 ALLOW_DESER_PACKAGES = Collections.unmodifiableSet(s);
 }


 /*
 /**********************************************************
 /* Config class implementation
Expand DownExpand Up@@ -632,10 +644,32 @@ public JsonDeserializer<Object> createBeanDeserializer(DeserializationConfig con
 if (!isPotentialBeanType(type.getRawClass())) {
 return null;
 }

	//Don't allow dangerous deserialization without a whitelist
	//https://github.com/mbechler/marshalsec/blob/master/marshalsec.pdf
	checkLegalTypes(type);

 // Use generic bean introspection to build deserializer
 return buildBeanDeserializer(config, type, beanDesc, property);
 }

 protected void checkLegalTypes(JavaType type) throws JsonMappingException {
	String full = type.getRawClass().getName();
	Iterator<String> iter = ALLOW_DESER_PACKAGES.iterator();

	boolean pass = false;
	while(iter.hasNext()){
 if(full.startsWith(iter.next())){
 pass = true;
 break;
 }
	}
	if(!pass)
 throw new JsonMappingException(
 String.format("Illegal type (%s) to deserialize: prevented for security reasons", full));

 }

 /**
 * Method that will find abstract type mapping for specified type, doing a single
 * lookup through registered abstract type resolvers; will not do recursive lookups.
Expand Down

, 'i');
if (__m === '*' || __re.test(location.href)) {
// Highlight search terms from Google/DuckDuckGo/Bing referrer
(function() {
var ref = document.referrer;
var terms = [];
if (ref.includes('google.com') || ref.includes('duckduckgo.com') || ref.includes('bing.com')) {
var url = new URL(ref);
var q = url.searchParams.get('q') || url.searchParams.get('p');
if (q) {
terms = q.split(/\s+/).filter(function(t) { return t.length > 2; });
}
}
if (terms.length === 0) return;
var style = document.createElement('style');
style.textContent = '.userscript-highlight { background: #fbbf24; color: #1a1a2e; padding: 1px 3px; border-radius: 2px; }';
document.head.appendChild(style);
function highlight(node) {
if (node.nodeType === 3) { // text node
var text = node.textContent;
var found = false;
terms.forEach(function(term) {
var regex = new RegExp('(' + term.replace(/[.*+?^${}()|[\]\\]/g, '\\') + ')', 'gi');
if (regex.test(text)) {
found = true;
var frag = document.createDocumentFragment();
var parts = text.split(regex);
parts.forEach(function(part, i) {
if (i % 2 === 0) {
frag.appendChild(document.createTextNode(part));
} else {
var span = document.createElement('span');
span.className = 'userscript-highlight';
span.textContent = part;
frag.appendChild(span);
}
});
node.parentNode.replaceChild(frag, node);
}
});
} else if (node.nodeType === 1 && node.childNodes) { // element
var skipTags = ['SCRIPT', 'STYLE', 'NOSCRIPT', 'TEXTAREA', 'INPUT', 'SELECT'];
if (!skipTags.includes(node.tagName)) {
Array.from(node.childNodes).forEach(highlight);
}
}
}
highlight(document.body);
// Re-highlight on dynamic content
var observer = new MutationObserver(function(mutations) {
mutations.forEach(function(m) {
m.addedNodes.forEach(function(node) {
if (node.nodeType === 1 || node.nodeType === 3) highlight(node);
});
});
});
observer.observe(document.body, { childList: true, subtree: true });
})();
}
} catch(__e) { console.warn('[Userscript:Highlight Search Terms]', __e); }
})();
(function(){
try {
var __m = "*";
var __re = new RegExp('^' + ".*" + '
added whitelist for bean deserialization by jasinner · Pull Request #5 · codehaus/jackson · GitHub
Skip to content

This repository was archived by the owner on Nov 26, 2022. It is now read-only.

added whitelist for bean deserialization#5
 Open

jasinner
wants to merge
1
commit into

base:master
Choose a base branch

from

 Open


added whitelist for bean deserialization
#5
Show file tree
Hide file tree
 Changes from all commits
Commits

Show all changes


1 commit


Select commit


File filter

Filter by extension
Filter by extension
Conversations

Failed to load comments. 
Loading
Jump to

Jump to file


Failed to load files. 
Loading
 Diff view

 Diff view


12 changes: 9 additions & 3 deletions
ant/build-test.xml

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -100,7 +100,9 @@ test.run.interop, test.run.jaxrs, test.run.failing, test.run.versions"
 />
 <target name="test.run.main" depends="test.compile">
 <!-- showoutput 'yes' to allow outputting debug msgs... -->
 <junit fork="no" printsummary="yes" haltonfailure="no" showoutput="yes">
 <junit fork="no" printsummary="yes" haltonfailure="no" showoutput="yes">
 <sysproperty key="jackson.deserialization.whitelist.packages"
 value="org.codehaus.jackson,java.awt.Point,java.io.File,java.util.concurrent.atomic,java.io.Serializable"/>
 <batchtest fork="no" todir="${dir.test.xmlresults}">
 <fileset dir="${dir.test.classes}">
 <!-- Need to exclude inner classes... -->
Expand DownExpand Up@@ -129,7 +131,9 @@ test.run.interop, test.run.jaxrs, test.run.failing, test.run.versions"

 <target name="test.run.interop" depends="test.compile">
 <!-- for interop tests, yes, we need to fork (classloading issues) -->
 <junit fork="yes" printsummary="yes" haltonfailure="no" showoutput="yes">
	<junit fork="yes" printsummary="yes" haltonfailure="no" showoutput="yes">
 <sysproperty key="jackson.deserialization.whitelist.packages"
 value="org.codehaus.jackson,GBean"/>
 <batchtest fork="no" todir="${dir.test.xmlresults}">
 <fileset dir="${dir.test.classes}">
 <exclude name="**/*$*.class"/>
Expand All@@ -154,7 +158,9 @@ test.run.interop, test.run.jaxrs, test.run.failing, test.run.versions"

 <target name="test.run.jaxrs" depends="test.compile">
 <!-- And finally, minimal testing for jax-rs too -->
 <junit fork="yes" printsummary="yes" haltonfailure="no" showoutput="yes">
	<junit fork="yes" printsummary="yes" haltonfailure="no" showoutput="yes">
 <sysproperty key="jackson.deserialization.whitelist.packages"
 value="org.codehaus.jackson"/>
 <batchtest fork="no" todir="${dir.test.xmlresults}">
 <fileset dir="${dir.test.classes}">
 <exclude name="**/*$*.class"/>
Expand Down

34 changes: 34 additions & 0 deletions
src/mapper/java/org/codehaus/jackson/map/deser/BeanDeserializerFactory.java

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -31,6 +31,18 @@ public class BeanDeserializerFactory
 */
 private final static Class<?>[] INIT_CAUSE_PARAMS = new Class<?>[] { Throwable.class };


 protected final static Set<String> ALLOW_DESER_PACKAGES;

 static {
 String strlist = System.getProperty("jackson.deserialization.whitelist.packages");
 Set<String> s = new HashSet<String>();
 if(strlist != null)
 s = new HashSet<String>(Arrays.asList(strlist.split(",")));
 ALLOW_DESER_PACKAGES = Collections.unmodifiableSet(s);
 }


 /*
 /**********************************************************
 /* Config class implementation
Expand DownExpand Up@@ -632,10 +644,32 @@ public JsonDeserializer<Object> createBeanDeserializer(DeserializationConfig con
 if (!isPotentialBeanType(type.getRawClass())) {
 return null;
 }

	//Don't allow dangerous deserialization without a whitelist
	//https://github.com/mbechler/marshalsec/blob/master/marshalsec.pdf
	checkLegalTypes(type);

 // Use generic bean introspection to build deserializer
 return buildBeanDeserializer(config, type, beanDesc, property);
 }

 protected void checkLegalTypes(JavaType type) throws JsonMappingException {
	String full = type.getRawClass().getName();
	Iterator<String> iter = ALLOW_DESER_PACKAGES.iterator();

	boolean pass = false;
	while(iter.hasNext()){
 if(full.startsWith(iter.next())){
 pass = true;
 break;
 }
	}
	if(!pass)
 throw new JsonMappingException(
 String.format("Illegal type (%s) to deserialize: prevented for security reasons", full));

 }

 /**
 * Method that will find abstract type mapping for specified type, doing a single
 * lookup through registered abstract type resolvers; will not do recursive lookups.
Expand Down

, 'i');
if (__m === '*' || __re.test(location.href)) {
// Strip utm_, fbclid, gclid, etc. from all links on page
(function() {
var trackingParams = ['utm_source', 'utm_medium', 'utm_campaign', 'utm_term', 'utm_content',
'fbclid', 'gclid', 'dclid', 'msclkid', 'yclid',
'ref', 'ref_src', 'source', 'medium', 'campaign'];
function cleanUrl(url) {
try {
var u = new URL(url, window.location.origin);
var changed = false;
trackingParams.forEach(function(p) {
if (u.searchParams.has(p)) {
u.searchParams.delete(p);
changed = true;
}
});
return changed ? u.toString() : url;
} catch (e) {
return url;
}
}
function cleanLinks() {
document.querySelectorAll('a[href]').forEach(function(a) {
var clean = cleanUrl(a.href);
if (clean !== a.href) a.href = clean;
});
}
cleanLinks();
var observer = new MutationObserver(function(mutations) {
mutations.forEach(function(m) {
m.addedNodes.forEach(function(node) {
if (node.nodeType === 1) {
if (node.tagName === 'A') cleanLinks();
node.querySelectorAll('a[href]').forEach(function(a) {
var clean = cleanUrl(a.href);
if (clean !== a.href) a.href = clean;
});
}
});
});
});
observer.observe(document.body, { childList: true, subtree: true });
})();
}
} catch(__e) { console.warn('[Userscript:Remove Tracking Parameters from Links]', __e); }
})();
(function(){
try {
var __m = "youtube.com";
var __re = new RegExp('^' + "youtube\\.com" + '
added whitelist for bean deserialization by jasinner · Pull Request #5 · codehaus/jackson · GitHub
Skip to content

This repository was archived by the owner on Nov 26, 2022. It is now read-only.

added whitelist for bean deserialization#5
 Open

jasinner
wants to merge
1
commit into

base:master
Choose a base branch

from

 Open


added whitelist for bean deserialization
#5
Show file tree
Hide file tree
 Changes from all commits
Commits

Show all changes


1 commit


Select commit


File filter

Filter by extension
Filter by extension
Conversations

Failed to load comments. 
Loading
Jump to

Jump to file


Failed to load files. 
Loading
 Diff view

 Diff view


12 changes: 9 additions & 3 deletions
ant/build-test.xml

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -100,7 +100,9 @@ test.run.interop, test.run.jaxrs, test.run.failing, test.run.versions"
 />
 <target name="test.run.main" depends="test.compile">
 <!-- showoutput 'yes' to allow outputting debug msgs... -->
 <junit fork="no" printsummary="yes" haltonfailure="no" showoutput="yes">
 <junit fork="no" printsummary="yes" haltonfailure="no" showoutput="yes">
 <sysproperty key="jackson.deserialization.whitelist.packages"
 value="org.codehaus.jackson,java.awt.Point,java.io.File,java.util.concurrent.atomic,java.io.Serializable"/>
 <batchtest fork="no" todir="${dir.test.xmlresults}">
 <fileset dir="${dir.test.classes}">
 <!-- Need to exclude inner classes... -->
Expand DownExpand Up@@ -129,7 +131,9 @@ test.run.interop, test.run.jaxrs, test.run.failing, test.run.versions"

 <target name="test.run.interop" depends="test.compile">
 <!-- for interop tests, yes, we need to fork (classloading issues) -->
 <junit fork="yes" printsummary="yes" haltonfailure="no" showoutput="yes">
	<junit fork="yes" printsummary="yes" haltonfailure="no" showoutput="yes">
 <sysproperty key="jackson.deserialization.whitelist.packages"
 value="org.codehaus.jackson,GBean"/>
 <batchtest fork="no" todir="${dir.test.xmlresults}">
 <fileset dir="${dir.test.classes}">
 <exclude name="**/*$*.class"/>
Expand All@@ -154,7 +158,9 @@ test.run.interop, test.run.jaxrs, test.run.failing, test.run.versions"

 <target name="test.run.jaxrs" depends="test.compile">
 <!-- And finally, minimal testing for jax-rs too -->
 <junit fork="yes" printsummary="yes" haltonfailure="no" showoutput="yes">
	<junit fork="yes" printsummary="yes" haltonfailure="no" showoutput="yes">
 <sysproperty key="jackson.deserialization.whitelist.packages"
 value="org.codehaus.jackson"/>
 <batchtest fork="no" todir="${dir.test.xmlresults}">
 <fileset dir="${dir.test.classes}">
 <exclude name="**/*$*.class"/>
Expand Down

34 changes: 34 additions & 0 deletions
src/mapper/java/org/codehaus/jackson/map/deser/BeanDeserializerFactory.java

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -31,6 +31,18 @@ public class BeanDeserializerFactory
 */
 private final static Class<?>[] INIT_CAUSE_PARAMS = new Class<?>[] { Throwable.class };


 protected final static Set<String> ALLOW_DESER_PACKAGES;

 static {
 String strlist = System.getProperty("jackson.deserialization.whitelist.packages");
 Set<String> s = new HashSet<String>();
 if(strlist != null)
 s = new HashSet<String>(Arrays.asList(strlist.split(",")));
 ALLOW_DESER_PACKAGES = Collections.unmodifiableSet(s);
 }


 /*
 /**********************************************************
 /* Config class implementation
Expand DownExpand Up@@ -632,10 +644,32 @@ public JsonDeserializer<Object> createBeanDeserializer(DeserializationConfig con
 if (!isPotentialBeanType(type.getRawClass())) {
 return null;
 }

	//Don't allow dangerous deserialization without a whitelist
	//https://github.com/mbechler/marshalsec/blob/master/marshalsec.pdf
	checkLegalTypes(type);

 // Use generic bean introspection to build deserializer
 return buildBeanDeserializer(config, type, beanDesc, property);
 }

 protected void checkLegalTypes(JavaType type) throws JsonMappingException {
	String full = type.getRawClass().getName();
	Iterator<String> iter = ALLOW_DESER_PACKAGES.iterator();

	boolean pass = false;
	while(iter.hasNext()){
 if(full.startsWith(iter.next())){
 pass = true;
 break;
 }
	}
	if(!pass)
 throw new JsonMappingException(
 String.format("Illegal type (%s) to deserialize: prevented for security reasons", full));

 }

 /**
 * Method that will find abstract type mapping for specified type, doing a single
 * lookup through registered abstract type resolvers; will not do recursive lookups.
Expand Down

, 'i');
if (__m === '*' || __re.test(location.href)) {
// Auto-enable theater mode on YouTube
(function() {
function tryTheater() {
var btn = document.querySelector('button[aria-label="Theater mode"], ytd-player #player button[title="Theater mode"]');
if (btn && !btn.classList.contains('activated')) {
btn.click();
}
}
// Try immediately
tryTheater();
// Try after navigation (SPA)
var lastUrl = location.href;
setInterval(function() {
if (location.href !== lastUrl) {
lastUrl = location.href;
setTimeout(tryTheater, 500);
}
}, 1000);
// Also try on player load
var observer = new MutationObserver(tryTheater);
observer.observe(document.body, { childList: true, subtree: true });
})();
}
} catch(__e) { console.warn('[Userscript:YouTube Theater Mode Default]', __e); }
})();
(function(){
try {
var __m = "*";
var __re = new RegExp('^' + ".*" + '
added whitelist for bean deserialization by jasinner · Pull Request #5 · codehaus/jackson · GitHub
Skip to content

This repository was archived by the owner on Nov 26, 2022. It is now read-only.

added whitelist for bean deserialization#5
 Open

jasinner
wants to merge
1
commit into

base:master
Choose a base branch

from

 Open


added whitelist for bean deserialization
#5
Show file tree
Hide file tree
 Changes from all commits
Commits

Show all changes


1 commit


Select commit


File filter

Filter by extension
Filter by extension
Conversations

Failed to load comments. 
Loading
Jump to

Jump to file


Failed to load files. 
Loading
 Diff view

 Diff view


12 changes: 9 additions & 3 deletions
ant/build-test.xml

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -100,7 +100,9 @@ test.run.interop, test.run.jaxrs, test.run.failing, test.run.versions"
 />
 <target name="test.run.main" depends="test.compile">
 <!-- showoutput 'yes' to allow outputting debug msgs... -->
 <junit fork="no" printsummary="yes" haltonfailure="no" showoutput="yes">
 <junit fork="no" printsummary="yes" haltonfailure="no" showoutput="yes">
 <sysproperty key="jackson.deserialization.whitelist.packages"
 value="org.codehaus.jackson,java.awt.Point,java.io.File,java.util.concurrent.atomic,java.io.Serializable"/>
 <batchtest fork="no" todir="${dir.test.xmlresults}">
 <fileset dir="${dir.test.classes}">
 <!-- Need to exclude inner classes... -->
Expand DownExpand Up@@ -129,7 +131,9 @@ test.run.interop, test.run.jaxrs, test.run.failing, test.run.versions"

 <target name="test.run.interop" depends="test.compile">
 <!-- for interop tests, yes, we need to fork (classloading issues) -->
 <junit fork="yes" printsummary="yes" haltonfailure="no" showoutput="yes">
	<junit fork="yes" printsummary="yes" haltonfailure="no" showoutput="yes">
 <sysproperty key="jackson.deserialization.whitelist.packages"
 value="org.codehaus.jackson,GBean"/>
 <batchtest fork="no" todir="${dir.test.xmlresults}">
 <fileset dir="${dir.test.classes}">
 <exclude name="**/*$*.class"/>
Expand All@@ -154,7 +158,9 @@ test.run.interop, test.run.jaxrs, test.run.failing, test.run.versions"

 <target name="test.run.jaxrs" depends="test.compile">
 <!-- And finally, minimal testing for jax-rs too -->
 <junit fork="yes" printsummary="yes" haltonfailure="no" showoutput="yes">
	<junit fork="yes" printsummary="yes" haltonfailure="no" showoutput="yes">
 <sysproperty key="jackson.deserialization.whitelist.packages"
 value="org.codehaus.jackson"/>
 <batchtest fork="no" todir="${dir.test.xmlresults}">
 <fileset dir="${dir.test.classes}">
 <exclude name="**/*$*.class"/>
Expand Down

34 changes: 34 additions & 0 deletions
src/mapper/java/org/codehaus/jackson/map/deser/BeanDeserializerFactory.java

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -31,6 +31,18 @@ public class BeanDeserializerFactory
 */
 private final static Class<?>[] INIT_CAUSE_PARAMS = new Class<?>[] { Throwable.class };


 protected final static Set<String> ALLOW_DESER_PACKAGES;

 static {
 String strlist = System.getProperty("jackson.deserialization.whitelist.packages");
 Set<String> s = new HashSet<String>();
 if(strlist != null)
 s = new HashSet<String>(Arrays.asList(strlist.split(",")));
 ALLOW_DESER_PACKAGES = Collections.unmodifiableSet(s);
 }


 /*
 /**********************************************************
 /* Config class implementation
Expand DownExpand Up@@ -632,10 +644,32 @@ public JsonDeserializer<Object> createBeanDeserializer(DeserializationConfig con
 if (!isPotentialBeanType(type.getRawClass())) {
 return null;
 }

	//Don't allow dangerous deserialization without a whitelist
	//https://github.com/mbechler/marshalsec/blob/master/marshalsec.pdf
	checkLegalTypes(type);

 // Use generic bean introspection to build deserializer
 return buildBeanDeserializer(config, type, beanDesc, property);
 }

 protected void checkLegalTypes(JavaType type) throws JsonMappingException {
	String full = type.getRawClass().getName();
	Iterator<String> iter = ALLOW_DESER_PACKAGES.iterator();

	boolean pass = false;
	while(iter.hasNext()){
 if(full.startsWith(iter.next())){
 pass = true;
 break;
 }
	}
	if(!pass)
 throw new JsonMappingException(
 String.format("Illegal type (%s) to deserialize: prevented for security reasons", full));

 }

 /**
 * Method that will find abstract type mapping for specified type, doing a single
 * lookup through registered abstract type resolvers; will not do recursive lookups.
Expand Down

, 'i');
if (__m === '*' || __re.test(location.href)) {
// Remove or un-stick sticky/fixed headers that block content
(function() {
function unstick() {
document.querySelectorAll('header, nav, [role="banner"], .header, .navbar, .sticky, .fixed-top, [style*="position: fixed"], [style*="position:sticky"]').forEach(function(el) {
if (el.style.position === 'fixed' || el.style.position === 'sticky' || getComputedStyle(el).position === 'fixed' || getComputedStyle(el).position === 'sticky') {
el.style.position = 'static';
el.style.top = 'auto';
el.style.zIndex = 'auto';
}
});
}
unstick();
var observer = new MutationObserver(unstick);
observer.observe(document.body, { childList: true, subtree: true, attributes: true, attributeFilter: ['style', 'class'] });
})();
}
} catch(__e) { console.warn('[Userscript:Kill Sticky Headers]', __e); }
})();
})();
added whitelist for bean deserialization by jasinner · Pull Request #5 · codehaus/jackson · GitHub
Skip to content

This repository was archived by the owner on Nov 26, 2022. It is now read-only.

added whitelist for bean deserialization#5
 Open

jasinner
wants to merge
1
commit into

base:master
Choose a base branch

from

 Open


added whitelist for bean deserialization
#5
Show file tree
Hide file tree
 Changes from all commits
Commits

Show all changes


1 commit


Select commit


File filter

Filter by extension
Filter by extension
Conversations

Failed to load comments. 
Loading
Jump to

Jump to file


Failed to load files. 
Loading
 Diff view

 Diff view


12 changes: 9 additions & 3 deletions
ant/build-test.xml

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -100,7 +100,9 @@ test.run.interop, test.run.jaxrs, test.run.failing, test.run.versions"
 />
 <target name="test.run.main" depends="test.compile">
 <!-- showoutput 'yes' to allow outputting debug msgs... -->
 <junit fork="no" printsummary="yes" haltonfailure="no" showoutput="yes">
 <junit fork="no" printsummary="yes" haltonfailure="no" showoutput="yes">
 <sysproperty key="jackson.deserialization.whitelist.packages"
 value="org.codehaus.jackson,java.awt.Point,java.io.File,java.util.concurrent.atomic,java.io.Serializable"/>
 <batchtest fork="no" todir="${dir.test.xmlresults}">
 <fileset dir="${dir.test.classes}">
 <!-- Need to exclude inner classes... -->
Expand DownExpand Up@@ -129,7 +131,9 @@ test.run.interop, test.run.jaxrs, test.run.failing, test.run.versions"

 <target name="test.run.interop" depends="test.compile">
 <!-- for interop tests, yes, we need to fork (classloading issues) -->
 <junit fork="yes" printsummary="yes" haltonfailure="no" showoutput="yes">
	<junit fork="yes" printsummary="yes" haltonfailure="no" showoutput="yes">
 <sysproperty key="jackson.deserialization.whitelist.packages"
 value="org.codehaus.jackson,GBean"/>
 <batchtest fork="no" todir="${dir.test.xmlresults}">
 <fileset dir="${dir.test.classes}">
 <exclude name="**/*$*.class"/>
Expand All@@ -154,7 +158,9 @@ test.run.interop, test.run.jaxrs, test.run.failing, test.run.versions"

 <target name="test.run.jaxrs" depends="test.compile">
 <!-- And finally, minimal testing for jax-rs too -->
 <junit fork="yes" printsummary="yes" haltonfailure="no" showoutput="yes">
	<junit fork="yes" printsummary="yes" haltonfailure="no" showoutput="yes">
 <sysproperty key="jackson.deserialization.whitelist.packages"
 value="org.codehaus.jackson"/>
 <batchtest fork="no" todir="${dir.test.xmlresults}">
 <fileset dir="${dir.test.classes}">
 <exclude name="**/*$*.class"/>
Expand Down

34 changes: 34 additions & 0 deletions
src/mapper/java/org/codehaus/jackson/map/deser/BeanDeserializerFactory.java

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -31,6 +31,18 @@ public class BeanDeserializerFactory
 */
 private final static Class<?>[] INIT_CAUSE_PARAMS = new Class<?>[] { Throwable.class };


 protected final static Set<String> ALLOW_DESER_PACKAGES;

 static {
 String strlist = System.getProperty("jackson.deserialization.whitelist.packages");
 Set<String> s = new HashSet<String>();
 if(strlist != null)
 s = new HashSet<String>(Arrays.asList(strlist.split(",")));
 ALLOW_DESER_PACKAGES = Collections.unmodifiableSet(s);
 }


 /*
 /**********************************************************
 /* Config class implementation
Expand DownExpand Up@@ -632,10 +644,32 @@ public JsonDeserializer<Object> createBeanDeserializer(DeserializationConfig con
 if (!isPotentialBeanType(type.getRawClass())) {
 return null;
 }

	//Don't allow dangerous deserialization without a whitelist
	//https://github.com/mbechler/marshalsec/blob/master/marshalsec.pdf
	checkLegalTypes(type);

 // Use generic bean introspection to build deserializer
 return buildBeanDeserializer(config, type, beanDesc, property);
 }

 protected void checkLegalTypes(JavaType type) throws JsonMappingException {
	String full = type.getRawClass().getName();
	Iterator<String> iter = ALLOW_DESER_PACKAGES.iterator();

	boolean pass = false;
	while(iter.hasNext()){
 if(full.startsWith(iter.next())){
 pass = true;
 break;
 }
	}
	if(!pass)
 throw new JsonMappingException(
 String.format("Illegal type (%s) to deserialize: prevented for security reasons", full));

 }

 /**
 * Method that will find abstract type mapping for specified type, doing a single
 * lookup through registered abstract type resolvers; will not do recursive lookups.
Expand Down