mirrors/nomulus
1
0
Fork 0
mirror of https://github.com/google/nomulus synced 2026-09-06 16:17:13 +00:00
Code Issues Releases Wiki Activity

Defend against deserialization-based attacks (#2150)

Browse Source 
* Defend against deserialization-based attacks

Added the `SafeObjectInputStream` class that defends attacks using
malformed serialized data, including remote code execution and
denial-of-service attacks.

Started using the new class to handle EPP resource VKeys and
PendingDeposits, which are passed across credential-boundaries: between
TaskQueue and AppEngine server, and between AppEngine server and the RDE
pipeline on GCE. Note that the wireformat of VKeys do not change,
therefore existing tasks sitting in the TaskQueue are not affected.

Also removed an unused class: JaxbFragment.
This commit is contained in:
Weimin Yu
2023-09-20 16:56:56 -04:00
committed by GitHub
parent fc1857717d
commit 46fdf2c996
11 changed files with 610 additions and 193 deletions
Download Patch File Download Diff File Expand all files Collapse all files
core/src/test/java/google/registry/rde/PendingDepositTest.java
+59
View File
@@ -0,0 +1,59 @@
// Copyright 2023 The Nomulus Authors. All Rights Reserved.
//
// Licensed under the Apache License, Version 2.0 (the "License");
// you may not use this file except in compliance with the License.
// You may obtain a copy of the License at
//
// http://www.apache.org/licenses/LICENSE-2.0
//
// Unless required by applicable law or agreed to in writing, software
// distributed under the License is distributed on an "AS IS" BASIS,
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
// See the License for the specific language governing permissions and
// limitations under the License.
package google.registry.rde;
import static com.google.common.truth.Truth.assertThat;
import static google.registry.model.common.Cursor.CursorType.RDE_STAGING;
import static google.registry.model.rde.RdeMode.FULL;
import static google.registry.util.SafeSerializationUtils.safeDeserialize;
import static google.registry.util.SerializeUtils.deserialize;
import static google.registry.util.SerializeUtils.serialize;
import org.joda.time.DateTime;
import org.joda.time.Duration;
import org.junit.jupiter.api.Test;
/** Unit tests for {@link PendingDeposit}. */
public class PendingDepositTest {
private final DateTime now = DateTime.parse("2000-01-01TZ");
PendingDeposit pendingDeposit =
PendingDeposit.create("soy", now, FULL, RDE_STAGING, Duration.standardDays(1));
PendingDeposit manualPendingDeposit =
PendingDeposit.createInManualOperation("soy", now, FULL, "/", null);
@Test
void deserialize_normalDeposit_success() {
assertThat(deserialize(PendingDeposit.class, serialize(pendingDeposit)))
.isEqualTo(pendingDeposit);
}
@Test
void deserialize_manualDeposit_success() {
assertThat(deserialize(PendingDeposit.class, serialize(manualPendingDeposit)))
.isEqualTo(manualPendingDeposit);
}
@Test
void safeDeserialize_normalDeposit_success() {
assertThat(safeDeserialize(serialize(pendingDeposit))).isEqualTo(pendingDeposit);
}
@Test
void safeDeserialize_manualDeposit_success() {
assertThat(safeDeserialize(serialize(manualPendingDeposit))).isEqualTo(manualPendingDeposit);
}
}
core/src/test/java/google/registry/xjc/JaxbFragmentTest.java
-56
View File
@@ -1,56 +0,0 @@
// Copyright 2017 The Nomulus Authors. All Rights Reserved.
//
// Licensed under the Apache License, Version 2.0 (the "License");
// you may not use this file except in compliance with the License.
// You may obtain a copy of the License at
//
// http://www.apache.org/licenses/LICENSE-2.0
//
// Unless required by applicable law or agreed to in writing, software
// distributed under the License is distributed on an "AS IS" BASIS,
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
// See the License for the specific language governing permissions and
// limitations under the License.
package google.registry.xjc;
import static com.google.common.truth.Truth.assertThat;
import static google.registry.testing.TestDataHelper.loadFile;
import static java.nio.charset.StandardCharsets.UTF_8;
import google.registry.xjc.rdehost.XjcRdeHostElement;
import java.io.ByteArrayInputStream;
import java.io.ByteArrayOutputStream;
import java.io.InputStream;
import java.io.ObjectInputStream;
import java.io.ObjectOutputStream;
import org.junit.jupiter.api.Test;
/** Unit tests for {@link JaxbFragment}. */
class JaxbFragmentTest {
private static final String HOST_FRAGMENT = loadFile(XjcObjectTest.class, "host_fragment.xml");
/** Verifies that a {@link JaxbFragment} can be serialized and deserialized successfully. */
@SuppressWarnings("unchecked")
@Test
void testJavaSerialization() throws Exception {
// Load rdeHost xml fragment into a jaxb object, wrap it, marshal, unmarshal, verify host.
// The resulting host name should be "ns1.example1.test", from the original xml fragment.
try (InputStream source = new ByteArrayInputStream(HOST_FRAGMENT.getBytes(UTF_8))) {
// Load xml
JaxbFragment<XjcRdeHostElement> hostFragment =
JaxbFragment.create(XjcXmlTransformer.unmarshal(XjcRdeHostElement.class, source));
// Marshal
ByteArrayOutputStream bout = new ByteArrayOutputStream();
new ObjectOutputStream(bout).writeObject(hostFragment);
// Unmarshal
ObjectInputStream in = new ObjectInputStream(new ByteArrayInputStream(bout.toByteArray()));
JaxbFragment<XjcRdeHostElement> restoredHostFragment =
(JaxbFragment<XjcRdeHostElement>) in.readObject();
// Verify host name
assertThat(restoredHostFragment.getInstance().getValue().getName())
.isEqualTo("ns1.example1.test");
}
}
}