tomdesair / tus-java-server / 28397616235

95%

push

github

🛡️ Sentinel: [CRITICAL] Fix insecure deserialization (#97)

* 🛡️ Sentinel: [CRITICAL] Fix insecure deserialization

🚨 Severity: CRITICAL
💡 Vulnerability: ObjectInputStream was used without restriction to deserialize objects from a file on disk. This is a potential risk for arbitrary code execution if an attacker is able to upload a maliciously crafted serialized object.
🎯 Impact: Remote code execution (RCE)
🔧 Fix: Replaced ObjectInputStream with ValidatingObjectInputStream (from commons-io) to explicitly allow-list accepted classes (`java.lang.*`, `java.util.*`, `me.desair.tus.server.*`).
✅ Verification: Ran unit tests and ensured that existing object serialization and deserialization functions correctly without regressions.

Co-authored-by: tomdesair <14034630+tomdesair@users.noreply.github.com>

* 🛡️ Sentinel: [CRITICAL] Fix insecure deserialization

🚨 Severity: CRITICAL
💡 Vulnerability: ObjectInputStream was used without restriction to deserialize objects from a file on disk. This is a potential risk for arbitrary code execution if an attacker is able to upload a maliciously crafted serialized object.
🎯 Impact: Remote code execution (RCE)
🔧 Fix: Replaced ObjectInputStream with ValidatingObjectInputStream (from commons-io) to explicitly allow-list accepted classes (`java.lang.*`, `java.util.*`, `me.desair.tus.server.*`). Also added a unit test to ensure that malicious classes are not deserialized.
✅ Verification: Ran unit tests and ensured that existing object serialization and deserialization functions correctly without regressions, while attempting to deserialize an unlisted class returns null.

Co-authored-by: tomdesair <14034630+tomdesair@users.noreply.github.com>

* Add unit test for validating object input stream

Co-authored-by: tomdesair <14034630+tomdesair@users.noreply.github.com>

* 🛡️ Sentinel: [CRITICAL] Fix insecure deserialization

🚨 Severity: CRITICAL
💡 Vulnerability: ObjectInputStream was used without restriction to deserialize obje... (continued)

622 of 700 branches covered (88.86%)

Branch coverage included in aggregate %.

3 of 3 new or added lines in 1 file covered. (100.0%)

1819 of 1866 relevant lines covered (97.48%)

6.59 hits per line