LPS-147076 Apply changes from

apache/velocity-engine#16 to SecureIntrospectorImpl to resolve CVE-2020-13936
liferay-tango · Sep 20, 2022 · 48afb31 · 48afb31
1 parent 1ae9f49
commit 48afb31
Show file tree

Hide file tree

Showing 2 changed files with 111 additions and 21 deletions.
diff --git a/modules/third-party/org-apache-velocity/patches/LPS-147076.patch b/modules/third-party/org-apache-velocity/patches/LPS-147076.patch
@@ -0,0 +1,79 @@
+diff --git a/org/apache/velocity/util/introspection/SecureIntrospectorImpl.java b/org/apache/velocity/util/introspection/SecureIntrospectorImpl.java
+index f317b1c6d8e7..ef687fb47024 100644
+--- a/org/apache/velocity/util/introspection/SecureIntrospectorImpl.java
++++ b/org/apache/velocity/util/introspection/SecureIntrospectorImpl.java
+@@ -87,30 +87,30 @@ public class SecureIntrospectorImpl extends Introspector implements SecureIntros
+      */
+     public boolean checkObjectExecutePermission(Class clazz, String methodName)
+     {
+-		/**
+-		 * check for wait and notify
+-		 */
++        /**
++         * check for wait and notify
++         */
+         if (methodName != null &&
+             (methodName.equals("wait") || methodName.equals("notify")) )
+-		{
+-			return false;
+-		}
++        {
++            return false;
++        }
+
+-		/**
+-		 * Always allow the most common classes - Number, Boolean and String
+-		 */
+-		else if (Number.class.isAssignableFrom(clazz))
+-		{
+-			return true;
+-		}
+-		else if (Boolean.class.isAssignableFrom(clazz))
+-		{
+-			return true;
+-		}
+-		else if (String.class.isAssignableFrom(clazz))
+-		{
+-			return true;
+-		}
++        /**
++         * Always allow the most common classes - Number, Boolean and String
++         */
++        else if (Number.class.isAssignableFrom(clazz))
++        {
++            return true;
++        }
++        else if (Boolean.class.isAssignableFrom(clazz))
++        {
++            return true;
++        }
++        else if (String.class.isAssignableFrom(clazz))
++        {
++            return true;
++        }
+
+         /**
+          * Always allow Class.getName()
+@@ -121,6 +121,15 @@ public class SecureIntrospectorImpl extends Introspector implements SecureIntros
+             return true;
+         }
+
++       /**
++       * Always disallow ClassLoader, Thread and subclasses
++       */
++        if (ClassLoader.class.isAssignableFrom(clazz) ||
++                Thread.class.isAssignableFrom(clazz))
++        {
++            return false;
++        }
++
+         /**
+          * check the classname (minus any array info)
+          * whether it matches disallowed classes or packages
+@@ -153,3 +162,5 @@ public class SecureIntrospectorImpl extends Introspector implements SecureIntros
+         return true;
+     }
+ }
++
++/* @generated */
+\ No newline at end of file
diff --git a/...velocity/src/main/java/org/apache/velocity/util/introspection/SecureIntrospectorImpl.java b/...velocity/src/main/java/org/apache/velocity/util/introspection/SecureIntrospectorImpl.java
@@ -87,30 +87,30 @@ public Method getMethod(Class clazz, String methodName, Object[] params)
      */
     public boolean checkObjectExecutePermission(Class clazz, String methodName)
     {
-		/**
-		 * check for wait and notify
-		 */
+        /**
+         * check for wait and notify
+         */
         if (methodName != null &&
             (methodName.equals("wait") || methodName.equals("notify")) )
-		{
-			return false;
-		}
+        {
+            return false;
+        }
 
-		/**
-		 * Always allow the most common classes - Number, Boolean and String
-		 */
-		else if (Number.class.isAssignableFrom(clazz))
-		{
-			return true;
-		}
-		else if (Boolean.class.isAssignableFrom(clazz))
-		{
-			return true;
-		}
-		else if (String.class.isAssignableFrom(clazz))
-		{
-			return true;
-		}
+        /**
+         * Always allow the most common classes - Number, Boolean and String
+         */
+        else if (Number.class.isAssignableFrom(clazz))
+        {
+            return true;
+        }
+        else if (Boolean.class.isAssignableFrom(clazz))
+        {
+            return true;
+        }
+        else if (String.class.isAssignableFrom(clazz))
+        {
+            return true;
+        }
 
         /**
          * Always allow Class.getName()
@@ -121,6 +121,15 @@ else if (Class.class.isAssignableFrom(clazz) &&
             return true;
         }
 
+       /**
+       * Always disallow ClassLoader, Thread and subclasses
+       */
+        if (ClassLoader.class.isAssignableFrom(clazz) ||
+                Thread.class.isAssignableFrom(clazz))
+        {
+            return false;
+        }
+
         /**
          * check the classname (minus any array info)
          * whether it matches disallowed classes or packages
@@ -153,3 +162,5 @@ else if (Class.class.isAssignableFrom(clazz) &&
         return true;
     }
 }
+
+/* @generated */