File velocity-engine-2.2-CVE-2020-13936.patch of Package velocity-engine

Overview Repositories Revisions Requests Users Attributes Meta

File velocity-engine-2.2-CVE-2020-13936.patch of Package velocity-engine (Revision 40dffda37401e8d75c7f6db54ab8015d)

Currently displaying revision 40dffda37401e8d75c7f6db54ab8015d , Show latest

Index: velocity-engine-2.2/velocity-engine-core/src/main/java/org/apache/velocity/util/introspection/SecureIntrospectorImpl.java
===================================================================
--- velocity-engine-2.2.orig/velocity-engine-core/src/main/java/org/apache/velocity/util/introspection/SecureIntrospectorImpl.java
+++ velocity-engine-2.2/velocity-engine-core/src/main/java/org/apache/velocity/util/introspection/SecureIntrospectorImpl.java
@@ -122,6 +122,15 @@ public class SecureIntrospectorImpl exte
         }
 
         /**
+         * Always disallow ClassLoader, Thread and subclasses
+         */
+        if (ClassLoader.class.isAssignableFrom(clazz) ||
+            Thread.class.isAssignableFrom(clazz))
+        {
+           return false;
+        }
+
+        /**
          * check the classname (minus any array info)
          * whether it matches disallowed classes or packages
          */
Index: velocity-engine-2.2/velocity-engine-core/src/main/resources/org/apache/velocity/runtime/defaults/velocity.properties
===================================================================
--- velocity-engine-2.2.orig/velocity-engine-core/src/main/resources/org/apache/velocity/runtime/defaults/velocity.properties
+++ velocity-engine-2.2/velocity-engine-core/src/main/resources/org/apache/velocity/runtime/defaults/velocity.properties
@@ -207,15 +207,14 @@ introspector.conversion_handler.class =
 # accessed.
 # ----------------------------------------------------------------------------
 
+# Prohibit reflection
 introspector.restrict.packages = java.lang.reflect
 
-# The two most dangerous classes
+# ClassLoader, Thread, and subclasses disabled by default in SecureIntrospectorImpl
 
+# Restrict these system classes.  Note that anything in this list is matched exactly.
+# (Subclasses must be explicitly named to be included).
 introspector.restrict.classes = java.lang.Class
-introspector.restrict.classes = java.lang.ClassLoader
-
-# Restrict these for extra safety
-
 introspector.restrict.classes = java.lang.Compiler
 introspector.restrict.classes = java.lang.InheritableThreadLocal
 introspector.restrict.classes = java.lang.Package
@@ -224,10 +223,17 @@ introspector.restrict.classes = java.lan
 introspector.restrict.classes = java.lang.RuntimePermission
 introspector.restrict.classes = java.lang.SecurityManager
 introspector.restrict.classes = java.lang.System
-introspector.restrict.classes = java.lang.Thread
 introspector.restrict.classes = java.lang.ThreadGroup
 introspector.restrict.classes = java.lang.ThreadLocal
 
+# Restrict instance managers for common servlet containers  (Tomcat, JBoss, Jetty)
+
+introspector.restrict.classes = org.apache.catalina.core.DefaultInstanceManager
+introspector.restrict.classes = org.apache.tomcat.SimpleInstanceManager
+introspector.restrict.classes = org.wildfly.extension.undertow.deployment.UndertowJSPInstanceManager
+introspector.restrict.classes = org.eclipse.jetty.util.DecoratedObjectFactory
+
+
 # ----------------------------------------------------------------------------
 # SPACE GOBBLING
 # ----------------------------------------------------------------------------

Places

File velocity-engine-2.2-CVE-2020-13936.patch of Package velocity-engine (Revision 40dffda37401e8d75c7f6db54ab8015d)

Places