File _service:tar_scm:CVE-2022-23307.patch of Package log4j12

File _service:tar_scm:CVE-2022-23307.patch of Package log4j12 (Revision 3df7166c660d3b3b0721340f96a68217)

Currently displaying revision 3df7166c660d3b3b0721340f96a68217 , Show latest

From: Markus Koschany <apo@debian.org>
Date: Mon, 31 Jan 2022 11:37:03 +0100
Subject: CVE-2022-23307

Origin: https://github.com/qos-ch/reload4j/commit/64902fe18ce5a5dd40487051a2f6231d9fbbe9b0
---
 .../org/apache/log4j/chainsaw/LoggingReceiver.java |  8 +-
 .../log4j/net/HardenedLoggingEventInputStream.java | 56 +++++++++++++
 .../log4j/net/HardenedObjectInputStream.java       | 93 +++++++++++++++++++++
 src/test/input/xml/socketAppenderForChainsaw.xml   | 24 ++++++
 .../org/apache/log4j/net/SocketAppenderTest.java   | 96 ++++++++++++++++++++++
 5 files changed, 273 insertions(+), 4 deletions(-)
 create mode 100644 src/main/java/org/apache/log4j/net/HardenedLoggingEventInputStream.java
 create mode 100644 src/main/java/org/apache/log4j/net/HardenedObjectInputStream.java
 create mode 100644 src/test/input/xml/socketAppenderForChainsaw.xml
 create mode 100644 src/test/java/org/apache/log4j/net/SocketAppenderTest.java

diff --git a/src/main/java/org/apache/log4j/chainsaw/LoggingReceiver.java b/src/main/java/org/apache/log4j/chainsaw/LoggingReceiver.java
index ca087ad..74ecc06 100644
--- a/src/main/java/org/apache/log4j/chainsaw/LoggingReceiver.java
+++ b/src/main/java/org/apache/log4j/chainsaw/LoggingReceiver.java
@@ -18,11 +18,11 @@ package org.apache.log4j.chainsaw;
 
 import java.io.EOFException;
 import java.io.IOException;
-import java.io.ObjectInputStream;
 import java.net.ServerSocket;
 import java.net.Socket;
 import java.net.SocketException;
 import org.apache.log4j.Logger;
+import org.apache.log4j.net.HardenedLoggingEventInputStream;
 import org.apache.log4j.spi.LoggingEvent;
 
 /**
@@ -58,10 +58,10 @@ class LoggingReceiver extends Thread {
         public void run() {
             LOG.debug("Starting to get data");
             try {
-                final ObjectInputStream ois =
-                    new ObjectInputStream(mClient.getInputStream());
+                final HardenedLoggingEventInputStream hleis =
+                    new HardenedLoggingEventInputStream(mClient.getInputStream());
                 while (true) {
-                    final LoggingEvent event = (LoggingEvent) ois.readObject();
+                    final LoggingEvent event = (LoggingEvent) hleis.readObject();
                     mModel.addEvent(new EventDetails(event));
                 }
             } catch (EOFException e) {
diff --git a/src/main/java/org/apache/log4j/net/HardenedLoggingEventInputStream.java b/src/main/java/org/apache/log4j/net/HardenedLoggingEventInputStream.java
new file mode 100644
index 0000000..f0f6a20
--- /dev/null
+++ b/src/main/java/org/apache/log4j/net/HardenedLoggingEventInputStream.java
@@ -0,0 +1,56 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one or more
+ * contributor license agreements.  See the NOTICE file distributed with
+ * this work for additional information regarding copyright ownership.
+ * The ASF licenses this file to You under the Apache License, Version 2.0
+ * (the "License"); you may not use this file except in compliance with
+ * the License.  You may obtain a copy of the License at
+ * 
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ * 
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.apache.log4j.net;
+
+import java.io.IOException;
+import java.io.InputStream;
+import java.util.ArrayList;
+import java.util.List;
+
+import org.apache.log4j.Level;
+import org.apache.log4j.Priority;
+import org.apache.log4j.spi.LocationInfo;
+import org.apache.log4j.spi.LoggingEvent;
+import org.apache.log4j.spi.ThrowableInformation;
+
+// === Copied from the logback project with permission ==
+public class HardenedLoggingEventInputStream extends HardenedObjectInputStream {
+
+    static final String ARRAY_PREFIX = "[L";
+
+    static public List<String> getWhilelist() {
+
+	List<String> whitelist = new ArrayList<String>();
+	whitelist.add(LoggingEvent.class.getName());
+	whitelist.add(Level.class.getName());
+	whitelist.add(Priority.class.getName());
+	whitelist.add(ThrowableInformation.class.getName());
+	whitelist.add(LocationInfo.class.getName());
+
+	return whitelist;
+    }
+
+    public HardenedLoggingEventInputStream(InputStream is) throws IOException {
+	super(is, getWhilelist());
+    }
+
+    public HardenedLoggingEventInputStream(InputStream is, List<String> additionalAuthorizedClasses)
+	    throws IOException {
+	this(is);
+	super.addToWhitelist(additionalAuthorizedClasses);
+    }
+}
diff --git a/src/main/java/org/apache/log4j/net/HardenedObjectInputStream.java b/src/main/java/org/apache/log4j/net/HardenedObjectInputStream.java
new file mode 100644
index 0000000..c911572
--- /dev/null
+++ b/src/main/java/org/apache/log4j/net/HardenedObjectInputStream.java
@@ -0,0 +1,93 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one or more
+ * contributor license agreements.  See the NOTICE file distributed with
+ * this work for additional information regarding copyright ownership.
+ * The ASF licenses this file to You under the Apache License, Version 2.0
+ * (the "License"); you may not use this file except in compliance with
+ * the License.  You may obtain a copy of the License at
+ * 
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ * 
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.apache.log4j.net;
+
+import java.io.IOException;
+import java.io.InputStream;
+import java.io.InvalidClassException;
+import java.io.ObjectInputStream;
+import java.io.ObjectStreamClass;
+import java.util.ArrayList;
+import java.util.List;
+
+/**
+ * HardenedObjectInputStream restricts the set of classes that can be
+ * deserialized to a set of explicitly whitelisted classes. This prevents
+ * certain type of attacks from being successful.
+ * 
+ * <p>
+ * It is assumed that classes in the "java.lang" and "java.util" packages are
+ * always authorized.
+ * </p>
+ * 
+ * @author Ceki G&uuml;lc&uuml;
+ * @since 1.2.18
+ * 
+ *        === Copied from the logback project with permission ==
+ */
+public class HardenedObjectInputStream extends ObjectInputStream {
+
+    static final String ARRAY_CLASS_PREFIX = "[L";
+    final List<String> whitelistedClassNames;
+    final static String[] JAVA_PACKAGES = new String[] { "java.lang", "java.util", ARRAY_CLASS_PREFIX + "java.lang" };
+
+    public HardenedObjectInputStream(InputStream in, String[] whilelist) throws IOException {
+	super(in);
+
+	this.whitelistedClassNames = new ArrayList<String>();
+	if (whilelist != null) {
+	    for (int i = 0; i < whilelist.length; i++) {
+		this.whitelistedClassNames.add(whilelist[i]);
+	    }
+	}
+    }
+
+    public HardenedObjectInputStream(InputStream in, List<String> whitelist) throws IOException {
+	super(in);
+
+	this.whitelistedClassNames = new ArrayList<String>();
+	this.whitelistedClassNames.addAll(whitelist);
+    }
+
+    @Override
+    protected Class<?> resolveClass(ObjectStreamClass anObjectStreamClass) throws IOException, ClassNotFoundException {
+
+	String incomingClassName = anObjectStreamClass.getName();
+
+	if (!isWhitelisted(incomingClassName)) {
+	    throw new InvalidClassException("Unauthorized deserialization attempt", incomingClassName);
+	}
+
+	return super.resolveClass(anObjectStreamClass);
+    }
+
+    private boolean isWhitelisted(String incomingClassName) {
+	for (int i = 0; i < JAVA_PACKAGES.length; i++) {
+	    if (incomingClassName.startsWith(JAVA_PACKAGES[i]))
+		return true;
+	}
+	for (String whiteListed : whitelistedClassNames) {
+	    if (incomingClassName.equals(whiteListed))
+		return true;
+	}
+	return false;
+    }
+
+    protected void addToWhitelist(List<String> additionalAuthorizedClasses) {
+	whitelistedClassNames.addAll(additionalAuthorizedClasses);
+    }
+}
\ No newline at end of file
diff --git a/src/test/input/xml/socketAppenderForChainsaw.xml b/src/test/input/xml/socketAppenderForChainsaw.xml
new file mode 100644
index 0000000..b022ba5
--- /dev/null
+++ b/src/test/input/xml/socketAppenderForChainsaw.xml
@@ -0,0 +1,24 @@
+<?xml version="1.0" encoding="UTF-8" ?>
+<!DOCTYPE log4j:configuration SYSTEM "log4j.dtd">
+
+<log4j:configuration debug="true" 
+xmlns:log4j='http://jakarta.apache.org/log4j/'>
+
+
+  
+  <appender name="REMOTE" class="org.apache.log4j.net.SocketAppender">
+    
+    <param name="RemoteHost" value="localhost"/>
+    <param name="Port" value="4445"/>
+    <param name="ReconnectionDelay" value="10"/>
+  </appender>
+
+  <root>
+    <priority value ="trace" />
+    <appender-ref ref="REMOTE" />
+  </root>
+
+        
+</log4j:configuration>
+
+ 
diff --git a/src/test/java/org/apache/log4j/net/SocketAppenderTest.java b/src/test/java/org/apache/log4j/net/SocketAppenderTest.java
new file mode 100644
index 0000000..6c4a390
--- /dev/null
+++ b/src/test/java/org/apache/log4j/net/SocketAppenderTest.java
@@ -0,0 +1,96 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one or more
+ * contributor license agreements.  See the NOTICE file distributed with
+ * this work for additional information regarding copyright ownership.
+ * The ASF licenses this file to You under the Apache License, Version 2.0
+ * (the "License"); you may not use this file except in compliance with
+ * the License.  You may obtain a copy of the License at
+ * 
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ * 
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package org.apache.log4j.net;
+
+import static org.apache.log4j.TestContants.TEST_INPUT_PREFIX;
+import static org.junit.Assert.assertEquals;
+
+import org.apache.log4j.AppenderSkeleton;
+import org.apache.log4j.Logger;
+import org.apache.log4j.spi.LoggingEvent;
+import org.apache.log4j.xml.DOMConfigurator;
+import org.junit.After;
+import org.junit.Before;
+import org.junit.Test;
+
+public class SocketAppenderTest {
+
+    /* JUnit's setUp and tearDown */
+
+    @Before
+    public void setUp() {
+	DOMConfigurator.configure(TEST_INPUT_PREFIX + "xml/SocketAppenderTestConfig.xml");
+	// DOMConfigurator.configure(TEST_INPUT_PREFIX +
+	// "xml/socketAppenderForChainsaw.xml");
+
+	logger = Logger.getLogger(SocketAppenderTest.class);
+	secondary = (LastOnlyAppender) Logger.getLogger("org.apache.log4j.net.SocketAppenderTestDummy")
+		.getAppender("lastOnly");
+    }
+
+    @After
+    public void tearDown() {
+    }
+
+    /* Tests */
+
+    @Test
+    public void testFallbackErrorHandlerWhenStarting() {
+	String msg = "testFallbackErrorHandlerWhenStarting";
+	logger.debug(msg);
+
+	// above debug log will fail and shoul be redirected to secondary appender
+	assertEquals("SocketAppender with FallbackErrorHandler", msg, secondary.getLastMessage());
+    }
+
+    /* Fields */
+
+    private static Logger logger;
+    private static LastOnlyAppender secondary;
+
+    /* Inner classes */
+
+    /**
+     * Inner-class For debugging purposes only Saves last LoggerEvent
+     */
+    static public class LastOnlyAppender extends AppenderSkeleton {
+	protected void append(LoggingEvent event) {
+	    this.lastEvent = event;
+	}
+
+	public boolean requiresLayout() {
+	    return false;
+	}
+
+	public void close() {
+	    this.closed = true;
+	}
+
+	/**
+	 * @return last appended LoggingEvent's message
+	 */
+	public String getLastMessage() {
+	    if (this.lastEvent != null)
+		return this.lastEvent.getMessage().toString();
+	    else
+		return "";
+	}
+
+	private LoggingEvent lastEvent;
+    };
+
+}
\ No newline at end of file