1+ import java .io .IOException ;
2+
3+ import javax .servlet .http .HttpServlet ;
4+ import javax .servlet .http .HttpServletRequest ;
5+ import javax .servlet .http .HttpServletResponse ;
6+
7+ import org .json .JSONObject ;
8+ import org .jabsorb .JSONSerializer ;
9+ import org .jabsorb .serializer .SerializerState ;
10+ import org .jabsorb .serializer .ObjectMatch ;
11+
12+ import com .example .User ;
13+ import com .thirdparty .Person ;
14+
15+ public class JabsorbServlet extends HttpServlet {
16+
17+ private static final long serialVersionUID = 1L ;
18+
19+ @ Override
20+ // GOOD: final class type specified
21+ public void doGet (HttpServletRequest req , HttpServletResponse resp ) throws IOException {
22+ String json = req .getParameter ("json" );
23+ String clazz = req .getParameter ("class" );
24+
25+ try {
26+ Object jsonObject = new JSONObject (json );
27+
28+ JSONSerializer serializer = new JSONSerializer ();
29+ serializer .registerDefaultSerializers ();
30+
31+ serializer .setMarshallClassHints (true );
32+ serializer .setMarshallNullAttributes (true );
33+
34+ SerializerState state = new SerializerState ();
35+ User user = (User ) serializer .unmarshall (state , User .class , jsonObject );
36+ } catch (Exception e ) {
37+ throw new IOException (e .getMessage ());
38+ }
39+ }
40+
41+ // GOOD: concrete class type specified even if it has vulnerable subclasses
42+ public void doHead (HttpServletRequest req , HttpServletResponse resp ) throws IOException {
43+ String json = req .getParameter ("json" );
44+ String clazz = req .getParameter ("class" );
45+
46+ try {
47+ Object jsonObject = new JSONObject (json );
48+
49+ JSONSerializer serializer = new JSONSerializer ();
50+ serializer .registerDefaultSerializers ();
51+
52+ serializer .setMarshallClassHints (true );
53+ serializer .setMarshallNullAttributes (true );
54+
55+ SerializerState state = new SerializerState ();
56+ Person person = (Person ) serializer .unmarshall (state , Person .class , jsonObject );
57+ } catch (Exception e ) {
58+ throw new IOException (e .getMessage ());
59+ }
60+ }
61+
62+ @ Override
63+ // GOOD: try unmarshall but doesn't actually marshall the object
64+ public void doPost (HttpServletRequest req , HttpServletResponse resp ) throws IOException {
65+ String json = req .getParameter ("json" );
66+ String clazz = req .getParameter ("class" );
67+
68+ try {
69+ Object jsonObject = new JSONObject (json );
70+
71+ JSONSerializer serializer = new JSONSerializer ();
72+ serializer .registerDefaultSerializers ();
73+
74+ serializer .setMarshallClassHints (true );
75+ serializer .setMarshallNullAttributes (true );
76+
77+ SerializerState state = new SerializerState ();
78+ ObjectMatch objMatch = serializer .tryUnmarshall (state , Class .forName (clazz ), jsonObject );
79+ User obj = new User ();
80+ boolean result = objMatch .equals (obj );
81+ } catch (Exception e ) {
82+ throw new IOException (e .getMessage ());
83+ }
84+ }
85+
86+ @ Override
87+ // BAD: allow class name to be controlled by remote source
88+ public void doPut (HttpServletRequest req , HttpServletResponse resp ) throws IOException {
89+ String json = req .getParameter ("json" );
90+ String clazz = req .getParameter ("class" );
91+
92+ try {
93+ Object jsonObject = new JSONObject (json );
94+
95+ JSONSerializer serializer = new JSONSerializer ();
96+ serializer .registerDefaultSerializers ();
97+
98+ serializer .setMarshallClassHints (true );
99+ serializer .setMarshallNullAttributes (true );
100+
101+ SerializerState state = new SerializerState ();
102+ User user = (User ) serializer .unmarshall (state , Class .forName (clazz ), jsonObject ); // $unsafeDeserialization
103+ } catch (Exception e ) {
104+ throw new IOException (e .getMessage ());
105+ }
106+ }
107+
108+ // BAD: allow explicit class type controlled by remote source in the format of "json={\"javaClass\":\"com.thirdparty.Attacker\", ...}"
109+ public void doPut2 (HttpServletRequest req , HttpServletResponse resp ) throws IOException {
110+ String json = req .getParameter ("json" );
111+
112+ try {
113+ JSONSerializer serializer = new JSONSerializer ();
114+ serializer .registerDefaultSerializers ();
115+
116+ User user = (User ) serializer .fromJSON (json ); // $unsafeDeserialization
117+ } catch (Exception e ) {
118+ throw new IOException (e .getMessage ());
119+ }
120+ }
121+ }
0 commit comments