search

cloudant-labs / clouseau

Expose Lucene features as an erlang-like node
Apache License 2.0
58 stars 32 forks source link

Remove CVE-implicated xml parser class #43

Closed rnewson closed 2 years ago

rnewson commented 2 years ago

The CoreParser class of lucene-queryparser's xml parser has an open CVE (CVE-2017-12629). This code is unreachable and unexploitable unless someone were to change Clouseau to permit users to submit queries in XML form.

We're removing the class anyway as we don't use it and never intend to.

iilyak commented 2 years ago

I am not sure it works as intended. The project has references to classes within org.apache.lucene:lucene-queryparser package. See for example here:

This means we cannot exclude the package completely. However the instructions in distribution.xml say to remove it completely.

Here is the result of my testing:

❯ git log --oneline -n 1
9ed5805 (HEAD -> github/pr/43) Remove CVE-implicated xml parser class

❯ mvn
....
[INFO] --- maven-assembly-plugin:2.3:single (default) @ clouseau ---
[INFO] Reading assembly descriptor: src/main/assembly/distribution.xml
[INFO] Building zip: /Users/iilyak@ca.ibm.com/dev/clouseau/target/clouseau-2.19.1-SNAPSHOT.zip
[INFO] Building tar: /Users/iilyak@ca.ibm.com/dev/clouseau/target/clouseau-2.19.1-SNAPSHOT.tar.gz

❯ unzip -l target/clouseau-2.19.1-SNAPSHOT.zip | grep queryparser
[nothing]

While on master I am getting

❯ unzip -l target/clouseau-2.19.1-SNAPSHOT.zip | grep queryparser
   383927  11-05-2021 05:11   clouseau-2.19.1-SNAPSHOT/lucene-queryparser-4.6.1.jar

I don't know what correct syntax for distribution.xml is needed to exclude a single class file.

rnewson commented 2 years ago

@iilyak The shade plugin copies the classes from lucene-queryparser into the clouseau.jar (an "uber" jar) but excludes any in the org.apache.lucene.queryparser.xml package. The distribution.xml changes then excludes the original lucene-queryparser-4.6.1.jar file as it is no longer needed (and contains the thing we wish to exclude).

We did this before in https://github.com/cloudant-labs/clouseau/commit/d0299351674bb9707599f606d2a43b77e328b3b7.

tonysun83 commented 2 years ago

+1

rnewson commented 2 years ago

great, thanks both for the thorough review.

rnewson commented 2 years ago

@tonysun83 @iilyak I need one of you to merge it, I don't have the priv yet.