Limit the nesting depth of `JsonReader` and document it as internal

Aperta
  • Qualcosa non va?
#4,463 0 commenti 0 reazioni 0 assegnatari Vedi su GitHub

I maintainer di solito rispondono entro 1 giorno

Nessuno ha ancora preso questa issue.

Valutazione

Difficoltà
4/5
Tempo stimato
3-5 giorni
Idoneità per principianti
55/100
Tipo di issue
Bug
Chiarezza
Specificata chiaramente
Stato di attività
Attiva
Stack tecnologico
java
Ambito
backend

Direzione di ricerca

Start with JsonReader in the 2.x and 3.x packages named in the issue, then inspect JsonTemplateLayoutCodecFuzzer and its existing tests. Add coverage for input one nesting level above the proposed limit and check the fuzzer’s input bound. Done means excessive nesting raises IllegalArgumentException, the fuzzer no longer expects stack overflows, and Javadocs describe the parser as internal and for trusted input; the package move is only a consideration.

Scritto dal modello di indicizzazione a partire dal testo della issue.

Descrizione

configuration enhancement layouts

Log4j contains a minimal JSON parser, JsonReader, used to parse Log4j's own configuration: JSON configuration files, the MutableThreadContextMapFilter configuration, property mappings, and JSON Template Layout templates and resolver configuration. In 2.x it lives in org.apache.logging.log4j.layout.template.json.util; in 3.x in org.apache.logging.log4j.kit.json, which log4j-kit exports (OSGi @Export, version 3.0.0) under the module description "Helpers to implement Log4j 2.x API".

The parser recurses through readToken(), readArray() and readObject() without a depth limit, so a deeply nested document (a few thousand levels with the default thread stack) ends in a StackOverflowError instead of the IllegalArgumentException thrown for other malformed input. JsonTemplateLayoutCodecFuzzer currently works around this by bounding the length of its input (see OSS-Fuzz issue 370272570). Moreover, nothing in the Javadoc says that the parser is meant only for Log4j's own, operator-supplied input, and the exported 3.x package can give the impression that it is a general-purpose JSON parser.

Proposal:

  1. Add a nesting-depth counter to JsonReader, incremented on entry to readArray() and readObject(), and throw an IllegalArgumentException once it exceeds a fixed limit (e.g. 128, far above the nesting of any real configuration file), in both 2.x and 3.x. Add a test parsing a document one level above the limit.
  2. Relax the input length bound of JsonTemplateLayoutCodecFuzzer and remove its comment about expected stack overflows.
  3. State in the Javadoc of JsonReader and of its package that it is an internal component intended only for trusted input. Before 3.0.0 GA, consider moving the 3.x class to a non-exported (internal) package.

This issue originates from a private security report classified as a hardening.

Lingua principale
Java
Stelle
3.6k
Fork
1.8k
Merge medio
5g 6h
PR unite (30g)
24

Preparare l'ambiente

  • Nessun Dockerfile né file Docker Compose
  • Ha un modello di pull request
  • Nessuna guida per i contributori

Come iniziare

  1. Leggi tutta la issue e poi la guida ai contributi del progetto.
  2. Commenta sulla issue per dire che te ne occupi tu — evita che due persone facciano lo stesso lavoro.
  3. Fai un fork del repository e lavora su un branch.
  4. Apri una pull request che faccia riferimento al numero della issue.

Altre issue di apache/logging-log4j2

Tutte le issue di apache/logging-log4j2

Issue simili

Altre issue su Java

Ricevi le nuove issue nella tua casella

Un breve riepilogo di issue GitHub adatte ai principianti.