Wire 7.1.0: Incompatible LENGTH_DELIMITED Encoding Is Silently Accepted for Singular Scalar Fields

Chiusa
  • Qualcosa non va?
#3,738 0 commenti 0 reazioni 0 assegnatari Vedi su GitHub

Una pull request collegata è già stata integrata.

  • #3740 di @oldergod — integrata

Valutazione

Difficoltà
4/5
Tempo stimato
3-5 giorni
Idoneità per principianti
48/100
Tipo di issue
Bug
Chiarezza
Specificata chiaramente
Stato di attività
Attiva
Stack tecnologico
kotlin
Ambito
backend-api-design

Direzione di ricerca

Start with RuntimeMessageAdapter.decode() and the ByteArrayProtoReader32 scalar decoding path named in the report. Reproduce with the proto2 AllTypes schema and input 0A 01 07, then inspect the existing tests for packed and unpacked repeated numeric fields. Done means incompatible length-delimited input no longer populates singular scalar fields while valid repeated-field encodings continue to work.

Scritto dal modello di indicizzazione a partire dal testo della issue.

Descrizione

Summary

Square Wire 7.1.0 incorrectly interprets LENGTH_DELIMITED Protobuf fields as values of singular scalar fields, even when the incoming wire type is incompatible with the declared schema.

Instead of treating the incompatible field as unknown or rejecting it, Wire silently assigns the decoded payload to the scalar field.

This causes incorrect message interpretation and may result in data integrity violations.

Affected Components

  • wire-runtime-jvm:7.1.0

  • wire-schema-jvm:7.1.0

  • RuntimeMessageAdapter.decode()

  • ByteArrayProtoReader32 scalar decoding

Minimal Reproduction

Example schema:

syntax = "proto2";
message AllTypes {
    optional int32 i32 = 1;
}

Input:

0A 01 07

The input encodes field 1 with wire type 2 (LENGTH_DELIMITED), although the declared singular int32 field ordinarily requires wire type 0 (VARINT).

Actual Result

protobuf-java 4.36.2: ACCEPTED {}
Wire 7.1.0: ACCEPTED {"i32"=i:7}
Jackson Protobuf 2.22.4: REJECTED (incompatible wire type)

Additional examples:

Input (hex) | Wire 7.1.0 Result -- | -- 0A 01 07 | i32 = 7 0A 02 01 02 | i32 = 2 12 01 61 | i64 = 97 3A 04 01 02 03 04 | f32 = 67305985 6A 01 01 | flag = true

In the second example, the two payload values are interpreted as packed scalar elements, and the singular field retains the final value.

Root Cause

The lower-level scalar decoding functions accept LENGTH_DELIMITED data to support packed repeated fields.

However, RuntimeMessageAdapter.decode() does not sufficiently verify whether packed encoding is valid for the declared field.

This allows an incompatible wire encoding to populate a singular scalar field.

Security Impact

This issue causes silent data interpretation differences rather than a parser crash.

Applications that validate Protobuf messages with one parser and process them with Wire may interpret the same input differently.

If such fields are used in security-sensitive decisions, inconsistent interpretation could undermine application-level validation.

Suggested Fix

Validate actual wire types against declared field encodings before invoking scalar adapters.

Preserve legitimate packed and unpacked representations of repeated numeric fields, while preventing incompatible encodings from populating singular scalar fields.

Related Finding

A related report documents an uncaught IllegalStateException when a message field uses an incompatible FIXED32 or FIXED64 wire type.

Both findings may share a missing wire-type validation check, but their security impacts differ.

Lingua principale
Kotlin
Stelle
4.4k
Fork
634
Merge medio
18h 3m
PR unite (30g)
5

Preparare l'ambiente

Come iniziare

  1. Leggi tutta la issue e poi la guida ai contributi del progetto.
  2. Commenta sulla issue per dire che te ne occupi tu — evita che due persone facciano lo stesso lavoro.
  3. Fai un fork del repository e lavora su un branch.
  4. Apri una pull request che faccia riferimento al numero della issue.

Altre issue di square/wire

Tutte le issue di square/wire

Issue simili

Altre issue su Kotlin

Ricevi le nuove issue nella tua casella

Un breve riepilogo di issue GitHub adatte ai principianti.