sentinel-hub / byoc-tool

Tool that prepares your data for use in Sentinel Hub
MIT License
7 stars 1 forks source link

upgrade twelvemonkeys dependency version #4

Open NEUZhangy opened 1 year ago

NEUZhangy commented 1 year ago

Hi, we found the insecure version of the dependency twelvemonkeys still used in the code : https://github.com/sentinel-hub/byoc-tool/blob/master/src/main/java/com/sinergise/sentinel/byoctool/tiff/TiffCompoundDirectory.java#L13, which may infinite loop in code. Test here:
JPEG link: https://github.com/haraldk/TwelveMonkeys/blob/4259903bddaadc94a7027ecece2351be3cd6ee9c/imageio/imageio-jpeg/src/test/resources/broken-jpeg/110115680-6d6dce80-7d84-11eb-99df-4cb21df3b09f.jpeg

public class TiffCompoundDirectoryTest {

    @Test(timeout = 1000L)
    public void testTiffCompoundDirectoryVulnerability() throws Exception {
        ImageInputStream malformedInput = createMalformedInput();

        try {
            new TiffCompoundDirectory(malformedInput);
        } catch (IIOException expected) {
            assertThat(expected.getMessage(), allOf(containsString("SOF"), containsString("stream")));
        }
    }

    private ImageInputStream createMalformedInput() throws IOException {
        File tempFile = File.createTempFile("temp-malformed", ".jpeg");

        ImageReader reader = createReader();

        try (ImageInputStream iis = ImageIO.createImageInputStream(getClassLoaderResource("/broken-jpeg/110115680-6d6dce80-7d84-11eb-99df-4cb21df3b09f.jpeg"))) {
            reader.setInput(iis);

            try {
                reader.read(0, null);
            } catch (IIOException expected) {
                assertThat(expected.getMessage(), allOf(containsString("SOF"), containsString("stream")));
            }
        }

        return ImageIO.createImageInputStream(tempFile);
    }

    private ImageReader createReader() {
        // Implement this method to return an ImageReader instance for JPEG
        // You can use the createReader() method from the original testInfiniteLoopCorrupt()
    }

    private static InputStream getClassLoaderResource(String path) {
        // Implement this method to return an InputStream for the given path
        // You can use the getClassLoaderResource() method from the original testInfiniteLoopCorrupt()
    }
}