Skip to content

Commit 09c612c

Browse files
authored
Change Defaults
**cherry-pick to 3.0.x, 2.4.x**
1 parent 8e3dd19 commit 09c612c

File tree

4 files changed

+32
-17
lines changed

4 files changed

+32
-17
lines changed

build.gradle

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -313,6 +313,8 @@ configure(javaProjects) { subproject ->
313313
if (name ==~ /(testAll)/) {
314314
systemProperty 'RUN_LONG_INTEGRATION_TESTS', 'true'
315315
}
316+
environment "SPRING_AMQP_DESERIALIZATION_TRUST_ALL", "true"
317+
316318
useJUnitPlatform()
317319
}
318320

spring-amqp/src/main/java/org/springframework/amqp/utils/SerializationUtils.java

Lines changed: 19 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
/*
2-
* Copyright 2006-2019 the original author or authors.
2+
* Copyright 2006-2023 the original author or authors.
33
*
44
* Licensed under the Apache License, Version 2.0 (the "License");
55
* you may not use this file except in compliance with the License.
@@ -38,6 +38,17 @@
3838
*/
3939
public final class SerializationUtils {
4040

41+
private static final String TRUST_ALL_ENV = "SPRING_AMQP_DESERIALIZATION_TRUST_ALL";
42+
43+
private static final String TRUST_ALL_PROP = "spring.amqp.deserialization.trust.all";
44+
45+
private static final boolean TRUST_ALL;
46+
47+
static {
48+
TRUST_ALL = Boolean.parseBoolean(System.getenv(TRUST_ALL_ENV))
49+
|| Boolean.parseBoolean(System.getProperty(TRUST_ALL_PROP));
50+
}
51+
4152
private SerializationUtils() {
4253
}
4354

@@ -137,11 +148,12 @@ protected Class<?> resolveClass(ObjectStreamClass classDesc)
137148
* @since 2.1
138149
*/
139150
public static void checkAllowedList(Class<?> clazz, Set<String> patterns) {
140-
if (ObjectUtils.isEmpty(patterns)) {
151+
if (TRUST_ALL && ObjectUtils.isEmpty(patterns)) {
141152
return;
142153
}
143154
if (clazz.isArray() || clazz.isPrimitive() || clazz.equals(String.class)
144-
|| Number.class.isAssignableFrom(clazz)) {
155+
|| Number.class.isAssignableFrom(clazz)
156+
|| String.class.equals(clazz)) {
145157
return;
146158
}
147159
String className = clazz.getName();
@@ -150,7 +162,10 @@ public static void checkAllowedList(Class<?> clazz, Set<String> patterns) {
150162
return;
151163
}
152164
}
153-
throw new SecurityException("Attempt to deserialize unauthorized " + clazz);
165+
throw new SecurityException("Attempt to deserialize unauthorized " + clazz
166+
+ "; add allowed class name patterns to the message converter or, if you trust the message orginiator, "
167+
+ "set environment variable '"
168+
+ TRUST_ALL_ENV + "' or system property '" + TRUST_ALL_PROP + "' to true");
154169
}
155170

156171
}

spring-amqp/src/test/java/org/springframework/amqp/support/converter/AllowedListDeserializingMessageConverterTests.java

Lines changed: 9 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
/*
2-
* Copyright 2016-2019 the original author or authors.
2+
* Copyright 2016-2023 the original author or authors.
33
*
44
* Licensed under the Apache License, Version 2.0 (the "License");
55
* you may not use this file except in compliance with the License.
@@ -17,7 +17,7 @@
1717
package org.springframework.amqp.support.converter;
1818

1919
import static org.assertj.core.api.Assertions.assertThat;
20-
import static org.assertj.core.api.Assertions.fail;
20+
import static org.assertj.core.api.Assertions.assertThatExceptionOfType;
2121

2222
import java.io.Serializable;
2323
import java.util.Collections;
@@ -40,7 +40,11 @@ public void testAllowedList() throws Exception {
4040
SerializerMessageConverter converter = new SerializerMessageConverter();
4141
TestBean testBean = new TestBean("foo");
4242
Message message = converter.toMessage(testBean, new MessageProperties());
43-
Object fromMessage = converter.fromMessage(message);
43+
// when env var not set
44+
// assertThatExceptionOfType(SecurityException.class).isThrownBy(() -> converter.fromMessage(message));
45+
Object fromMessage;
46+
// when env var set.
47+
fromMessage = converter.fromMessage(message);
4448
assertThat(fromMessage).isEqualTo(testBean);
4549

4650
converter.setAllowedListPatterns(Collections.singletonList("*"));
@@ -54,15 +58,8 @@ public void testAllowedList() throws Exception {
5458
fromMessage = converter.fromMessage(message);
5559
assertThat(fromMessage).isEqualTo(testBean);
5660

57-
try {
58-
converter.setAllowedListPatterns(Collections.singletonList("foo.*"));
59-
fromMessage = converter.fromMessage(message);
60-
assertThat(fromMessage).isEqualTo(testBean);
61-
fail("Expected SecurityException");
62-
}
63-
catch (SecurityException e) {
64-
65-
}
61+
converter.setAllowedListPatterns(Collections.singletonList("foo.*"));
62+
assertThatExceptionOfType(SecurityException.class).isThrownBy(() -> converter.fromMessage(message));
6663
}
6764

6865
@SuppressWarnings("serial")

src/reference/asciidoc/amqp.adoc

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -4407,14 +4407,15 @@ consider configuring which packages and classes are allowed to be deserialized.
44074407
This applies to both the `SimpleMessageConverter` and `SerializerMessageConverter` when it is configured to use a
44084408
`DefaultDeserializer` either implicitly or via configuration.
44094409
4410-
By default, the allowed list is empty, meaning all classes are deserialized.
4410+
By default, the allowed list is empty, meaning no classes will be deserialized.
44114411
44124412
You can set a list of patterns, such as `thing1.*`, `thing1.thing2.Cat` or `*.MySafeClass`.
44134413
44144414
The patterns are checked in order until a match is found.
44154415
If there is no match, a `SecurityException` is thrown.
44164416
44174417
You can set the patterns using the `allowedListPatterns` property on these converters.
4418+
Alternatively, if you trust all message originators, you can set the environment variable `SPRING_AMQP_DESERIALIZATION_TRUST_ALL` or system property `spring.amqp.deserialization.trust.all` to `true`.
44184419
====
44194420

44204421
[[message-properties-converters]]

0 commit comments

Comments
 (0)