search

hypfvieh / dbus-java

Improved version of java DBus library provided by freedesktop.org (https://dbus.freedesktop.org/doc/dbus-java/)
https://hypfvieh.github.io/dbus-java/
MIT License
185 stars 73 forks source link

Potential leak of application internals in ExportedObject.getAnnotations() #18

Closed hal0 closed 6 years ago

hal0 commented 6 years ago

If a DBusInterface adds any class-level annotations that have a value() method, even if they do not pertain to DBus itself, they will get leaked as introspection data to any clients that care.

In the case of an annotation including information pertaining to implementation details (including crypto suites, hard-coded hostnames, etc.) this information would be freely transmitted to the user.

This is because ExportedObject.getAnnotations() does not filter which annotations it includes in the introspection data:

https://github.com/hypfvieh/dbus-java/blob/master/src/main/java/org/freedesktop/dbus/messages/ExportedObject.java#L56-L67

hypfvieh commented 6 years ago

Thanks for the report. I don't have much spare time atm, but I hope the fix I just commited will handle this issue

hal0 commented 6 years ago

I have not tried it, but 01381b9a2851243e8a99083444316ca609cded6c appears to break all annotations, as Annotation will never be an instance of DBusInterface. You would have to use annotation.annotationType().isAssignableFrom(DBusInterface.class), which also would never evaluate to true since that would never be the case.

If I may make a recommendation, create a @DBusAnnotation annotation that is used to annotate other annotations that should be considered by the method referred to in 01381b9a2851243e8a99083444316ca609cded6c, which would enumerate each annotation and check if annotation.annotationType().getAnnotation(DBusAnnotation.class) != null, in which case the former annotation would be included in the introspection output.

This creates an explicit API that pushes the security concerns onto the consumer of dbus-java, allowing them to make those security decisions.

Further, as far as I'm aware, annotations within introspection data that don't pertain to D-Bus proper aren't used by any of the standard tooling and thus are rather useless to anyone that doesn't explicitly consume them via the org.freedesktop.DBus.Introspectable interface (see Introspection Format from the spec, which as of this writing outlines only 4 annotations).

Therefore, this could potentially be moot and only the annotations that D-Bus cares about could be checked (i.e. calling iface.getAnnotation(DBusInterfaceName.class) directly). This would be slightly simpler code as well as much more restrictive and thus more secure.

Thank you for the response - the concern is appreciated.

Just a suggestion. Thank you for your response.

hypfvieh commented 6 years ago

If you already have a proper fix, please provide a pull request and will merge it.

hypfvieh commented 6 years ago

any news on this? Did you review my changes?

hypfvieh commented 6 years ago

as there is no feedback yet, I assume this issue is fixed.