bugfix snake yaml decode rce (#1239)

apache · Sep 13, 2023 · a030f42 · a030f42
1 parent 4acf981
commit a030f42
Show file tree

Hide file tree

Showing 2 changed files with 17 additions and 1 deletion.
diff --git a/manager/src/main/java/org/dromara/hertzbeat/manager/controller/AppController.java b/manager/src/main/java/org/dromara/hertzbeat/manager/controller/AppController.java
@@ -48,6 +48,8 @@
 @RequestMapping(path = "/api/apps", produces = {APPLICATION_JSON_VALUE})
 public class AppController {
 
+    private static final String[] RISKY_STR_ARR = {"ScriptEngineManager", "URLClassLoader"};
+
     @Autowired
     private AppService appService;
 
@@ -91,6 +93,13 @@ public ResponseEntity<Message<Void>> deleteAppDefineYml(
     @Operation(summary = "Add new monitoring type define yml", description = "新增监控类型的定义YML")
     public ResponseEntity<Message<Void>> newAppDefineYml(@Valid @RequestBody MonitorDefineDto defineDto) {
         try {
+            for (String riskyToken : RISKY_STR_ARR) {
+                if (defineDto.getDefine().contains(riskyToken)) {
+                    return ResponseEntity.ok(Message.<Void>builder()
+                            .code(CommonConstants.FAIL_CODE)
+                            .msg("can not has malicious remote script").build());
+                }   
+            }
             appService.applyMonitorDefineYml(defineDto.getDefine(), false);
         } catch (Exception e) {
             return ResponseEntity.ok(Message.fail(FAIL_CODE, e.getMessage()));
@@ -102,6 +111,13 @@ public ResponseEntity<Message<Void>> newAppDefineYml(@Valid @RequestBody Monitor
     @Operation(summary = "Update monitoring type define yml", description = "更新监控类型的定义YML")
     public ResponseEntity<Message<Void>> updateAppDefineYml(@Valid @RequestBody MonitorDefineDto defineDto) {
         try {
+            for (String riskyToken : RISKY_STR_ARR) {
+                if (defineDto.getDefine().contains(riskyToken)) {
+                    return ResponseEntity.ok(Message.<Void>builder()
+                            .code(CommonConstants.FAIL_CODE)
+                            .msg("can not has malicious remote script").build());
+                }
+            }
             appService.applyMonitorDefineYml(defineDto.getDefine(), true);
         } catch (Exception e) {
             return ResponseEntity.ok(Message.fail(FAIL_CODE, e.getMessage()));

diff --git a/pom.xml b/pom.xml
@@ -52,7 +52,7 @@
         <lombok.version>1.18.20</lombok.version>
         <slf4j.version>1.7.36</slf4j.version>
         <xml.bind.version>2.3.0</xml.bind.version>
-        <snake.yaml.version>1.32</snake.yaml.version>
+        <snake.yaml.version>1.33</snake.yaml.version>
         <kafka-clients.version>3.4.0</kafka-clients.version>
 
         <mysql.version>8.0.30</mysql.version>