Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

DecodeableRpcInvocation增加入参类型校验 #6374

Merged
merged 4 commits into from
Jul 1, 2020
Merged

DecodeableRpcInvocation增加入参类型校验 #6374

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
b2dc3cb
Merge pull request #1 from apache/master
aquariuspj Jun 27, 2020
8fcdca1
// check parameterTypesDesc to fix CVE-2020-1948
aquariuspj Jun 27, 2020
c3f96a8
Merge branch 'master' of https://github.com/aquariuspj/incubator-dubbo
aquariuspj Jun 27, 2020
72db493
Merge branch 'master' into master
chickenlj Jul 1, 2020
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
1 change: 1 addition & 0 deletions dubbo-common/src/main/java/org/apache/dubbo/common/constants/CommonConstants.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -197,6 +197,7 @@ public interface CommonConstants {
*/
String $INVOKE = "$invoke";
String $INVOKE_ASYNC = "$invokeAsync";
String GENERIC_PARAMETER_DESC = "Ljava/lang/String;[Ljava/lang/String;[Ljava/lang/Object;";

/**
* package version in the manifest
Expand Down
1 change: 1 addition & 0 deletions dubbo-rpc/dubbo-rpc-api/src/main/java/org/apache/dubbo/rpc/Constants.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -27,6 +27,7 @@ public interface Constants {
String DEPRECATED_KEY = "deprecated";

String $ECHO = "$echo";
String $ECHO_PARAMETER_DESC = "Ljava/lang/Object;";

String RETURN_PREFIX = "return ";

Expand Down
3 changes: 1 addition & 2 deletions dubbo-rpc/dubbo-rpc-api/src/main/java/org/apache/dubbo/rpc/filter/GenericImplFilter.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -43,6 +43,7 @@

import static org.apache.dubbo.common.constants.CommonConstants.$INVOKE;
import static org.apache.dubbo.common.constants.CommonConstants.$INVOKE_ASYNC;
import static org.apache.dubbo.common.constants.CommonConstants.GENERIC_PARAMETER_DESC;
import static org.apache.dubbo.rpc.Constants.GENERIC_KEY;

/**
Expand All @@ -55,8 +56,6 @@ public class GenericImplFilter implements Filter, Filter.Listener {

private static final Class<?>[] GENERIC_PARAMETER_TYPES = new Class<?>[]{String.class, String[].class, Object[].class};

private static final String GENERIC_PARAMETER_DESC = "Ljava/lang/String;[Ljava/lang/String;[Ljava/lang/Object;";

private static final String GENERIC_IMPL_MARKER = "GENERIC_IMPL";

@Override
Expand Down
12 changes: 8 additions & 4 deletions dubbo-rpc/dubbo-rpc-api/src/main/java/org/apache/dubbo/rpc/support/RpcUtils.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -34,9 +34,11 @@

import static org.apache.dubbo.common.constants.CommonConstants.$INVOKE;
import static org.apache.dubbo.common.constants.CommonConstants.$INVOKE_ASYNC;
import static org.apache.dubbo.common.constants.CommonConstants.GENERIC_PARAMETER_DESC;
import static org.apache.dubbo.common.constants.CommonConstants.TIMEOUT_ATTACHMENT_KEY;
import static org.apache.dubbo.common.constants.CommonConstants.TIMEOUT_KEY;
import static org.apache.dubbo.rpc.Constants.$ECHO;
import static org.apache.dubbo.rpc.Constants.$ECHO_PARAMETER_DESC;
import static org.apache.dubbo.rpc.Constants.ASYNC_KEY;
import static org.apache.dubbo.rpc.Constants.AUTO_ATTACH_INVOCATIONID_KEY;
import static org.apache.dubbo.rpc.Constants.ID_KEY;
Expand Down Expand Up @@ -176,12 +178,14 @@ public static boolean isGenericAsync(Invocation inv) {
return $INVOKE_ASYNC.equals(inv.getMethodName());
}

public static boolean isGenericCall(String path, String method) {
return $INVOKE.equals(method) || $INVOKE_ASYNC.equals(method);
// check parameterTypesDesc to fix CVE-2020-1948
public static boolean isGenericCall(String parameterTypesDesc, String method) {
return ($INVOKE.equals(method) || $INVOKE_ASYNC.equals(method)) && GENERIC_PARAMETER_DESC.equals(parameterTypesDesc);
}

public static boolean isEcho(String path, String method) {
return $ECHO.equals(method);
// check parameterTypesDesc to fix CVE-2020-1948
public static boolean isEcho(String parameterTypesDesc, String method) {
return $ECHO.equals(method) && $ECHO_PARAMETER_DESC.equals(parameterTypesDesc);
}

public static InvokeMode getInvokeMode(URL url, Invocation inv) {
Expand Down
2 changes: 1 addition & 1 deletion ...-rpc-dubbo/src/main/java/org/apache/dubbo/rpc/protocol/dubbo/DecodeableRpcInvocation.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -130,7 +130,7 @@ public Object decode(Channel channel, InputStream input) throws IOException {
}
}
if (pts == DubboCodec.EMPTY_CLASS_ARRAY) {
if (!RpcUtils.isGenericCall(path, getMethodName()) && !RpcUtils.isEcho(path, getMethodName())) {
if (!RpcUtils.isGenericCall(desc, getMethodName()) && !RpcUtils.isEcho(desc, getMethodName())) {
throw new IllegalArgumentException("Service not found:" + path + ", " + getMethodName());
}
pts = ReflectUtils.desc2classArray(desc);
Expand Down