Repository navigation
Conversation
Apply an ObjectInputFilter when the deferred-task servlet reads its payload (a default blocklist, overridable via the appengine.deferredtask.serialFilter system property and merged with any JVM-wide jdk.serialFilter); legitimate DeferredTask payloads are unaffected. Also disable DTDs and external entities in the XML config parsers (XmlUtils and AppEngineWebXmlInitialParse), which read appengine-web.xml, queue.xml, cron.xml, dos.xml, etc. Adds unit tests for both changes; existing DeferredTaskServletTest (11) and AppEngineWebXmlInitialParseTest (37) pass, and deferred tasks and push task-queue delivery were verified working end to end.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
Defense-in-depth hardening of input handling in the runtime:
Deferred-task servlet (
DeferredTaskServlet, bothjavaxandjakartavariants): apply an
ObjectInputFilterwhen reading the task payload, with adefault blocklist overridable via the
appengine.deferredtask.serialFiltersystem property and merged with any JVM-wide
jdk.serialFilter. LegitimateDeferredTaskpayloads are unaffected.XML config parsing (
XmlUtilsandAppEngineWebXmlInitialParse): disableDTDs / external entities / external DTD and schema access when parsing
appengine-web.xml,queue.xml,cron.xml,dos.xml, etc.Testing
New unit tests for both changes; existing
DeferredTaskServletTest(11) andAppEngineWebXmlInitialParseTest(37) pass. Verified end-to-end on App Enginethat deferred tasks and push task-queue delivery continue to work with the
change in place.
Rationale and detailed verification shared separately.