Open QiAnXinCodeSafe opened 4 years ago
Could you expand on why this is a problem ? The value
in ProjectsController
can be indeed arbitrary (although currently this administrative interface is protected by localhost filter) however there has to be a setter for the field and Jackson has to be able to form an object from the string value. So, the validation happens when JSON is converted to Java object.
As suggested in https://github.com/oracle/opengrok/pull/2962#discussion_r336719935 the DTO design pattern should be used to access data via API. This should help to get rid of any "JSON injection".
opengrok-master/opengrok-web/src/main/java/org/opengrok/web/api/v1/controller/ProjectsController.java![image](https://user-images.githubusercontent.com/39950310/64309337-d37e6780-cfce-11e9-88a9-40c0b245f0ba.png)
opengrok-master/opengrok-indexer/src/main/java/org/opengrok/indexer/util/ClassUtil.java
![image](https://user-images.githubusercontent.com/39950310/64309394-edb84580-cfce-11e9-865e-3b8ac09c22f1.png)
The method writes unvalidated input into JSON. This call could allow an attacker to inject arbitrary elements or attributes into the JSON entity.