Skip to content

Commit 7e70e8e

Browse files
qxoqxo
committedSep 21, 2020
1. generated diff CVE diff git diff ad5a630 -- src/main/java/com/fasterxml/jackson/databind/jsontype/impl/SubTypeValidator.java 2. cleanup the diff ,just remain the CVE change 3. apply the diff 4. check and make sure only commit the AutoType CVE change. ``` PR_LIST=$(git log1 -n 17 ad5a630 -- src/main/java/com/fasterxml/jackson/databind/jsontype/impl/SubTypeValidator.java | awk -F'[ ,]+' '{for(i=1;i<=NF;i++){a=$(i);if(match(a,/#[0-9]+/)){print a;}}}' | sort | uniq);echo "$PR_LIST" | wc -l echo $PR_LIST ```
1 parent d52f91e commit 7e70e8e

File tree

1 file changed

+78
-11
lines changed

1 file changed

+78
-11
lines changed
 

‎src/main/java/com/fasterxml/jackson/databind/jsontype/impl/SubTypeValidator.java

+78-11
Original file line numberDiff line numberDiff line change
@@ -48,6 +48,9 @@ public class SubTypeValidator
4848
// [databind#1737]; 3rd party
4949
//s.add("org.springframework.aop.support.AbstractBeanFactoryPointcutAdvisor"); // deprecated by [databind#1855]
5050
s.add("org.springframework.beans.factory.config.PropertyPathFactoryBean");
51+
// [databind#2680]
52+
s.add("org.springframework.aop.config.MethodLocatingFactoryBean");
53+
s.add("org.springframework.beans.factory.config.BeanReferenceFactoryBean");
5154

5255
// s.add("com.mchange.v2.c3p0.JndiRefForwardingDataSource"); // deprecated by [databind#1931]
5356
// s.add("com.mchange.v2.c3p0.WrapperConnectionPoolDataSource"); // - "" -
@@ -73,24 +76,26 @@ public class SubTypeValidator
7376
s.add("com.sun.deploy.security.ruleset.DRSHelper");
7477
s.add("org.apache.axis2.jaxws.spi.handler.HandlerResolverImpl");
7578

76-
// [databind#2186]: yet more 3rd party gadgets
79+
// [databind#2186], [databind#2670]: yet more 3rd party gadgets
7780
s.add("org.jboss.util.propertyeditor.DocumentEditor");
7881
s.add("org.apache.openjpa.ee.RegistryManagedRuntime");
7982
s.add("org.apache.openjpa.ee.JNDIManagedRuntime");
80-
s.add("org.apache.axis2.transport.jms.JMSOutTransportInfo");
81-
82-
// [databind#2326] (2.7.9.6): one more 3rd party gadget
83+
s.add("org.apache.openjpa.ee.WASRegistryManagedRuntime"); // [#2670] addition
84+
s.add("org.apache.axis2.transport.jms.JMSOutTransportInfo");
85+
86+
// [databind#2326] (2.9.9)
8387
s.add("com.mysql.cj.jdbc.admin.MiniAdmin");
8488

85-
// [databind#2334]: logback-core
89+
// [databind#2334]: logback-core (2.9.9.1)
8690
s.add("ch.qos.logback.core.db.DriverManagerConnectionSource");
8791

88-
// [databind#2341]: jdom/jdom2
92+
// [databind#2341]: jdom/jdom2 (2.9.9.1)
8993
s.add("org.jdom.transform.XSLTransformer");
9094
s.add("org.jdom2.transform.XSLTransformer");
9195

92-
// [databind#2387]: EHCache
96+
// [databind#2387], [databind#2460]: EHCache
9397
s.add("net.sf.ehcache.transaction.manager.DefaultTransactionManagerLookup");
98+
s.add("net.sf.ehcache.hibernate.EhcacheJtaTransactionManagerLookup");
9499

95100
// [databind#2389]: logback/jndi
96101
s.add("ch.qos.logback.core.db.JNDIConnectionSource");
@@ -107,8 +112,10 @@ public class SubTypeValidator
107112
s.add("org.apache.commons.configuration.JNDIConfiguration");
108113
s.add("org.apache.commons.configuration2.JNDIConfiguration");
109114

110-
// [databind#2469]: xalan2
115+
// [databind#2469]: xalan
111116
s.add("org.apache.xalan.lib.sql.JNDIConnectionPool");
117+
// [databind#2704]: xalan2
118+
s.add("com.sun.org.apache.xalan.internal.lib.sql.JNDIConnectionPool");
112119

113120
// [databind#2478]: comons-dbcp, p6spy
114121
s.add("org.apache.commons.dbcp.datasources.PerUserPoolDataSource");
@@ -129,15 +136,75 @@ public class SubTypeValidator
129136
// [databind#2631]: shaded hikari-config
130137
s.add("org.apache.hadoop.shaded.com.zaxxer.hikari.HikariConfig");
131138

132-
// [databind#2634]: ibatis-sqlmap, anteros-core
139+
// [databind#2634]: ibatis-sqlmap, anteros-core/-dbcp
133140
s.add("com.ibatis.sqlmap.engine.transaction.jta.JtaTransactionConfig");
134141
s.add("br.com.anteros.dbcp.AnterosDBCPConfig");
142+
// [databind#2814]: anteros-dbcp
143+
s.add("br.com.anteros.dbcp.AnterosDBCPDataSource");
135144

136-
// [databind#2642]: javax.swing (jdk)
145+
// [databind#2642][databind#2854]: javax.swing (jdk)
137146
s.add("javax.swing.JEditorPane");
147+
s.add("javax.swing.JTextPane");
138148

139-
// [databind#2648]: shire-core
149+
// [databind#2648], [databind#2653]: shire-core
140150
s.add("org.apache.shiro.realm.jndi.JndiRealmFactory");
151+
s.add("org.apache.shiro.jndi.JndiObjectFactory");
152+
153+
// [databind#2658]: ignite-jta (, quartz-core)
154+
s.add("org.apache.ignite.cache.jta.jndi.CacheJndiTmLookup");
155+
s.add("org.apache.ignite.cache.jta.jndi.CacheJndiTmFactory");
156+
s.add("org.quartz.utils.JNDIConnectionProvider");
157+
158+
// [databind#2659]: aries.transaction.jms
159+
s.add("org.apache.aries.transaction.jms.internal.XaPooledConnectionFactory");
160+
s.add("org.apache.aries.transaction.jms.RecoverablePooledConnectionFactory");
161+
162+
// [databind#2660]: caucho-quercus
163+
s.add("com.caucho.config.types.ResourceRef");
164+
165+
// [databind#2662]: aoju/bus-proxy
166+
s.add("org.aoju.bus.proxy.provider.RmiProvider");
167+
s.add("org.aoju.bus.proxy.provider.remoting.RmiProvider");
168+
169+
// [databind#2664]: activemq-core, activemq-pool, activemq-pool-jms
170+
171+
s.add("org.apache.activemq.ActiveMQConnectionFactory"); // core
172+
s.add("org.apache.activemq.ActiveMQXAConnectionFactory");
173+
s.add("org.apache.activemq.spring.ActiveMQConnectionFactory");
174+
s.add("org.apache.activemq.spring.ActiveMQXAConnectionFactory");
175+
s.add("org.apache.activemq.pool.JcaPooledConnectionFactory"); // pool
176+
s.add("org.apache.activemq.pool.PooledConnectionFactory");
177+
s.add("org.apache.activemq.pool.XaPooledConnectionFactory");
178+
s.add("org.apache.activemq.jms.pool.XaPooledConnectionFactory"); // pool-jms
179+
s.add("org.apache.activemq.jms.pool.JcaPooledConnectionFactory");
180+
181+
// [databind#2666]: apache/commons-jms
182+
s.add("org.apache.commons.proxy.provider.remoting.RmiProvider");
183+
184+
// [databind#2682]: commons-jelly
185+
s.add("org.apache.commons.jelly.impl.Embedded");
186+
187+
// [databind#2688]: apache/drill
188+
s.add("oadd.org.apache.xalan.lib.sql.JNDIConnectionPool");
189+
190+
// [databind#2698]: weblogic w/ oracle/aq-jms
191+
// (note: dependency not available via Maven Central, but as part of
192+
// weblogic installation, possibly fairly old version(s))
193+
s.add("oracle.jms.AQjmsQueueConnectionFactory");
194+
s.add("oracle.jms.AQjmsXATopicConnectionFactory");
195+
s.add("oracle.jms.AQjmsTopicConnectionFactory");
196+
s.add("oracle.jms.AQjmsXAQueueConnectionFactory");
197+
s.add("oracle.jms.AQjmsXAConnectionFactory");
198+
199+
// [databind#2764]: org.jsecurity:
200+
s.add("org.jsecurity.realm.jndi.JndiRealmFactory");
201+
202+
// [databind#2798]: com.pastdev.httpcomponents:
203+
s.add("com.pastdev.httpcomponents.configuration.JndiConfiguration");
204+
205+
// [databind#2826], [databind#2827]
206+
s.add("com.nqadmin.rowset.JdbcRowSetImpl");
207+
s.add("org.arrah.framework.rdbms.UpdatableJdbcRowsetImpl");
141208

142209
DEFAULT_NO_DESER_CLASS_NAMES = Collections.unmodifiableSet(s);
143210
}

0 commit comments

Comments
 (0)
Please sign in to comment.