Type:
Status:
Resolved
Priority:
Resolution:
Fixed
Affects Version/s:
None
Right now, there's no check in allowed packages in ReflectData and SpecificData .
That could be problematic for marshalling/unmarshalling, as the as malicious payload can exploit the host system.
I propose to introduce a org.apache.avro.TRUSTED_PACKAGES system property:
-Dorg.apache.avro.TRUSTED_PACKAGES=my.package ,my.other.package ,...
In case we want to shortcut the mechanism, we would be able to allow all packages to be trusted using * wildcard:
-Dorg.apache.avro.TRUSTED_PACKAGES=*
By default, I would recommend to have limited trusted packages: java.lang,javax.security,java.util,org.apache.avro .
{"report":{"fcp":3599.8999977111816,"ttfb":850.6999969482422,"pageVisibility":"visible","entityId":13577934,"key":"jira.project.issue.view-issue","isInitial":true,"threshold":1000,"elementTimings":{"app-header":3599.8999977111816},"userDeviceMemory":8,"userDeviceProcessors":4,"apdex":0.5,"firstPaint":3599,"journeyId":"d2b69e2b-7784-42eb-8a4f-1150b67e8e56","navigationType":0,"readyForUser":3635.8999977111816,"redirectCount":0,"resourceLoadedEnd":3321.599998474121,"resourceLoadedStart":859.0999984741211,"resourceTiming":[{"duration":542.0999984741211,"initiatorType":"link","name":"https://issues.apache.org/jira/s/b62489a2eaac59d9b8a093c1a51d034f-CDN/-lmjgmc/820010/13pdxe5/49fa3aa3d35a2cc689cbf274e66cc41a/_/download/contextbatch/css/_super/batch.css","startTime":859.0999984741211,"connectEnd":859.0999984741211,"connectStart":859.0999984741211,"domainLookupEnd":859.0999984741211,"domainLookupStart":859.0999984741211,"fetchStart":859.0999984741211,"redirectEnd":0,"redirectStart":0,"requestStart":1107.7999992370605,"responseEnd":1401.1999969482422,"responseStart":1384.8999977111816,"secureConnectionStart":859.0999984741211},{"duration":814.2999992370605,"initiatorType":"script","name":"https://issues.apache.org/jira/s/d41d8cd98f00b204e9800998ecf8427e-CDN/-lmjgmc/820010/13pdxe5/1.0/_/download/batch/jira.webresources:calendar-en/jira.webresources:calendar-en.js","startTime":859.2999992370605,"connectEnd":1403.599998474121,"connectStart":861.2999992370605,"domainLookupEnd":859.2999992370605,"domainLookupStart":859.2999992370605,"fetchStart":859.2999992370605,"redirectEnd":0,"redirectStart":0,"requestStart":1403.6999969482422,"responseEnd":1673.599998474121,"responseStart":1673.1999969482422,"secureConnectionStart":1135.8999977111816},{"duration":1503.7999992370605,"initiatorType":"link","name":"https://issues.apache.org/jira/s/56490edcf9d54e35149505f78cca6a47-CDN/-lmjgmc/820010/13pdxe5/b47f517ea42fe259329e1c62e16103ee/_/download/contextbatch/css/jira.browse.project,jira.view.issue,project.issue.navigator,atl.general,atl.global,jira.global,jira.general,-_super/batch.css?agile_global_admin_condition=true&jag=true&jira.create.linked.issue=true&richediton=true&slack-enabled=true","startTime":859.2999992370605,"connectEnd":1368.6999969482422,"connectStart":860.7999992370605,"domainLookupEnd":859.2999992370605,"domainLookupStart":859.2999992370605,"fetchStart":859.2999992370605,"redirectEnd":0,"redirectStart":0,"requestStart":1368.6999969482422,"responseEnd":2363.099998474121,"responseStart":1630.099998474121,"secureConnectionStart":1118.2999992370605},{"duration":1844.099998474121,"initiatorType":"script","name":"https://issues.apache.org/jira/s/53f99ef99b2e1fdfc7d23fe8a1863381-CDN/-lmjgmc/820010/13pdxe5/49fa3aa3d35a2cc689cbf274e66cc41a/_/download/contextbatch/js/_super/batch.js?locale=en-UK","startTime":859.2999992370605,"connectEnd":1398.2999992370605,"connectStart":861,"domainLookupEnd":859.2999992370605,"domainLookupStart":859.2999992370605,"fetchStart":859.2999992370605,"redirectEnd":0,"redirectStart":0,"requestStart":1398.3999977111816,"responseEnd":2703.3999977111816,"responseStart":1675.5,"secureConnectionStart":1132.599998474121},{"duration":2462.2999992370605,"initiatorType":"script","name":"https://issues.apache.org/jira/s/f41fedb92d91357392ecb3ffb4e7aa1a-CDN/-lmjgmc/820010/13pdxe5/b47f517ea42fe259329e1c62e16103ee/_/download/contextbatch/js/jira.browse.project,jira.view.issue,project.issue.navigator,atl.general,atl.global,jira.global,jira.general,-_super/batch.js?agile_global_admin_condition=true&jag=true&jira.create.linked.issue=true&locale=en-UK&richediton=true&slack-enabled=true","startTime":859.2999992370605,"connectEnd":859.2999992370605,"connectStart":859.2999992370605,"domainLookupEnd":859.2999992370605,"domainLookupStart":859.2999992370605,"fetchStart":859.2999992370605,"redirectEnd":0,"redirectStart":0,"requestStart":1401.3999977111816,"responseEnd":3321.599998474121,"responseStart":1679.7999992370605,"secureConnectionStart":859.2999992370605},{"duration":1055.7000007629395,"initiatorType":"script","name":"https://issues.apache.org/jira/s/d41d8cd98f00b204e9800998ecf8427e-CDN/-lmjgmc/820010/13pdxe5/1.0/_/download/batch/jira.webresources:calendar-localisation-moment/jira.webresources:calendar-localisation-moment.js","startTime":859.3999977111816,"connectEnd":859.3999977111816,"connectStart":859.3999977111816,"domainLookupEnd":859.3999977111816,"domainLookupStart":859.3999977111816,"fetchStart":859.3999977111816,"redirectEnd":0,"redirectStart":0,"requestStart":1652.7999992370605,"responseEnd":1915.099998474121,"responseStart":1914.599998474121,"secureConnectionStart":859.3999977111816},{"duration":793.0999984741211,"initiatorType":"link","name":"https://issues.apache.org/jira/s/981f587853769311cda7c3b845131a06-CDN/-lmjgmc/820010/13pdxe5/cb5a5495a038c0744457f25821ba9ee8/_/download/contextbatch/css/jira.global.look-and-feel,-_super/batch.css","startTime":859.5,"connectEnd":1389.6999969482422,"connectStart":861.3999977111816,"domainLookupEnd":859.5,"domainLookupStart":859.5,"fetchStart":859.5,"redirectEnd":0,"redirectStart":0,"requestStart":1389.6999969482422,"responseEnd":1652.599998474121,"responseStart":1652.1999969482422,"secureConnectionStart":1129.099998474121},{"duration":1074.6999969482422,"initiatorType":"script","name":"https://issues.apache.org/jira/rest/api/1.0/shortcuts/820010/13d0e3ba62194e16a034b080ac028ecf/shortcuts.js?context=issuenavigation&context=issueaction","startTime":859.5,"connectEnd":859.5,"connectStart":859.5,"domainLookupEnd":859.5,"domainLookupStart":859.5,"fetchStart":859.5,"redirectEnd":0,"redirectStart":0,"requestStart":1668.099998474121,"responseEnd":1934.1999969482422,"responseStart":1932.6999969482422,"secureConnectionStart":859.5},{"duration":783.3000030517578,"initiatorType":"link","name":"https://issues.apache.org/jira/s/3ac36323ba5e4eb0af2aa7ac7211b4bb-CDN/-lmjgmc/820010/13pdxe5/efa42a25652b26dfd802540c024826b3/_/download/contextbatch/css/com.atlassian.jira.projects.sidebar.init,-_super,-jira.view.issue,-project.issue.navigator/batch.css?jira.create.linked.issue=true&richediton=true","startTime":884.6999969482422,"connectEnd":1397.099998474121,"connectStart":885.5,"domainLookupEnd":884.6999969482422,"domainLookupStart":884.6999969482422,"fetchStart":884.6999969482422,"redirectEnd":0,"redirectStart":0,"requestStart":1397.099998474121,"responseEnd":1668,"responseStart":1663.3999977111816,"secureConnectionStart":1132.099998474121},{"duration":1060.2999992370605,"initiatorType":"script","name":"https://issues.apache.org/jira/s/725d168f5dfc78dc46dd2ffc69a01a23-CDN/-lmjgmc/820010/13pdxe5/efa42a25652b26dfd802540c024826b3/_/download/contextbatch/js/com.atlassian.jira.projects.sidebar.init,-_super,-jira.view.issue,-project.issue.navigator/batch.js?jira.create.linked.issue=true&locale=en-UK&richediton=true","startTime":884.7999992370605,"connectEnd":884.7999992370605,"connectStart":884.7999992370605,"domainLookupEnd":884.7999992370605,"domainLookupStart":884.7999992370605,"fetchStart":884.7999992370605,"redirectEnd":0,"redirectStart":0,"requestStart":1673.8999977111816,"responseEnd":1945.099998474121,"responseStart":1943.6999969482422,"secureConnectionStart":884.7999992370605},{"duration":1623.6000022888184,"initiatorType":"script","name":"https://issues.apache.org/jira/s/d41d8cd98f00b204e9800998ecf8427e-CDN/-lmjgmc/820010/13pdxe5/1.0/_/download/batch/jira.webresources:bigpipe-js/jira.webresources:bigpipe-js.js","startTime":1107.8999977111816,"connectEnd":1107.8999977111816,"connectStart":1107.8999977111816,"domainLookupEnd":1107.8999977111816,"domainLookupStart":1107.8999977111816,"fetchStart":1107.8999977111816,"redirectEnd":0,"redirectStart":0,"requestStart":2467.099998474121,"responseEnd":2731.5,"responseStart":2731.099998474121,"secureConnectionStart":1107.8999977111816},{"duration":1861.6999969482422,"initiatorType":"script","name":"https://issues.apache.org/jira/s/d41d8cd98f00b204e9800998ecf8427e-CDN/-lmjgmc/820010/13pdxe5/1.0/_/download/batch/jira.webresources:bigpipe-init/jira.webresources:bigpipe-init.js","startTime":1108,"connectEnd":1108,"connectStart":1108,"domainLookupEnd":1108,"domainLookupStart":1108,"fetchStart":1108,"redirectEnd":0,"redirectStart":0,"requestStart":2706.8999977111816,"responseEnd":2969.699996948242,"responseStart":2969.199996948242,"secureConnectionStart":1108},{"duration":270.60000228881836,"initiatorType":"xmlhttprequest","name":"https://issues.apache.org/jira/rest/webResources/1.0/resources","startTime":2756.3999977111816,"connectEnd":2756.3999977111816,"connectStart":2756.3999977111816,"domainLookupEnd":2756.3999977111816,"domainLookupStart":2756.3999977111816,"fetchStart":2756.3999977111816,"redirectEnd":0,"redirectStart":0,"requestStart":2757.199996948242,"responseEnd":3027,"responseStart":3026.599998474121,"secureConnectionStart":2756.3999977111816}],"fetchStart":0,"domainLookupStart":0,"domainLookupEnd":0,"connectStart":1,"connectEnd":562,"secureConnectionStart":293,"requestStart":562,"responseStart":850,"responseEnd":1107,"domLoading":853,"domInteractive":3666,"domContentLoadedEventStart":3666,"domContentLoadedEventEnd":3683,"domComplete":3931,"loadEventStart":3931,"loadEventEnd":3933,"userAgent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36","marks":[{"name":"bigPipe.sidebar-id.start","time":3648.199996948242},{"name":"bigPipe.sidebar-id.end","time":3648.5},{"name":"bigPipe.activity-panel-pipe-id.start","time":3648.599998474121},{"name":"bigPipe.activity-panel-pipe-id.end","time":3649.3999977111816},{"name":"activityTabFullyLoaded","time":3690.699996948242}],"measures":[],"correlationId":"2e2afe245caa2a","effectiveType":"4g","downlink":1.45,"rtt":250,"serverDuration":96,"dbReadsTimeInMs":1,"dbConnsTimeInMs":9,"applicationHash":"ace47f9899e9ee25d7157d59aa17ab06aee30d3d","experiments":[]}}
Improvement
Major
Jean-Baptiste Onofré
added a comment - - edited opwvhk I'm proposing the opposite: don't trust any package by default and "invite" the user to clearly state the packages he trusts.
For the context, I did a similar implementation in ActiveMQ ( https://activemq.apache.org/components/classic/documentation/objectmessage ). 
I'm confused... one the one hand, the org.apache.avro.TRUSTED_PACKAGES property seems to be a whitelist of packages we allow to be used.
However, this does not match with the suggested value of "java.lang,javax.security,java.util,org.apache.avro", as these are are packages I think users are not allowed to use.
Is the intent to ensure we allow reflection in ReflectData and SpecificData to only use trusted packages?