π‘οΈ Sentinel: [CRITICAL/HIGH] Fix Unhandled Exception DoS in glob parsing#225
π‘οΈ Sentinel: [CRITICAL/HIGH] Fix Unhandled Exception DoS in glob parsing#225seonghobae wants to merge 1 commit into
Conversation
Javaμ `FileSystems.getDefault().getPathMatcher("glob:$pattern")`λ νμμ΄ μλͺ»λ ν¨ν΄(μ: `glob:` λλ μ΄μ€μΌμ΄ν μ€λ₯ λ±)μ΄ μ
λ ₯λ κ²½μ° `IllegalArgumentException`μ λ°μμν΅λλ€.
κΈ°μ‘΄ μ½λμμλ `java.util.regex.PatternSyntaxException`λ§ catch νλλ‘ μμ±λμ΄ μμμΌλ, μ΄λ `IllegalArgumentException`μ νμ ν΄λμ€μΌ λΏμ΄λ―λ‘, λ€λ₯Έ νμ μ€λ₯λ‘ μΈν `IllegalArgumentException` λ°μ μ μ΄ν리μΌμ΄μ
ν¬λμ(DoS)κ° λ°μνμ΅λλ€.
μ΄ μ»€λ°μ `IllegalArgumentException` μ 체λ₯Ό catch νλλ‘ μμ νμ¬ μ²λ¦¬λμ§ μμ μμΈλ‘ μΈν μλΉμ€ κ±°λΆ μ·¨μ½μ μ λ°©μ§ν©λλ€.
|
π Jules, reporting for duty! I'm here to lend a hand with this pull request. When you start a review, I'll add a π emoji to each comment to let you know I've read it. I'll focus on feedback directed at me and will do my best to stay out of conversations between you and other bots or reviewers to keep the noise down. I'll push a commit with your requested changes shortly after. Please note there might be a delay between these steps, but rest assured I'm on the job! For more direct control, you can switch me to Reactive Mode. When this mode is on, I will only act on comments where you specifically mention me with New to Jules? Learn more at jules.google/docs. For security, I will only act on instructions from the user who triggered this task. |
π¨ Severity: CRITICAL/HIGH
π‘ Vulnerability:
html4treeμ ν리μΌμ΄μ μ μ€μ νμΌ(.html4ignore)μμ μ¬μ©μ μ 곡 glob ν¨ν΄μ νμ±ν λFileSystems.getDefault().getPathMatcher()λ₯Ό μ¬μ©ν©λλ€. κΈ°μ‘΄ μ½λλjava.util.regex.PatternSyntaxExceptionλ§ μ²λ¦¬νμμΌλ,getPathMatcherλ μλͺ»λ λ¬Έλ²μ λν΄ κ·Έ μμ ν΄λμ€μΈIllegalArgumentExceptionμ λμ§λ κ²½μ°(μ: λΉ λ¬Έμμ΄,[λ± λ¬Έλ² μ€λ₯)κ° μμ΅λλ€. μ²λ¦¬λμ§ μμIllegalArgumentExceptionμ΄ λ°μνλ©΄ μ 체 μ ν리μΌμ΄μ ν¬λμ(DoS)λ‘ μ΄μ΄μ§λλ€.π― Impact: 곡격μκ° μ μμ μΌλ‘ μ‘°μλ
.html4ignoreνμΌ(μ:[ν κΈμλ§ ν¬ν¨)μ λμ λλ ν 리μ μμΉμν€κ±°λ μμ±νκ² νλ©΄, ν΄λΉ λλ ν 리λ₯Ό ν¬λ‘€λ§νλ μκ° ν¬λ‘€λ¬ μ 체 νλ‘μΈμ€κ° μ€λ¨λλ DoS κ³΅κ²©μ΄ κ°λ₯ν©λλ€.π§ Fix:
process_ignore_fileλ΄λΆμtry-catchλΈλ‘μμcatchλμμjava.util.regex.PatternSyntaxExceptionμμ μμ μμΈμΈIllegalArgumentExceptionμΌλ‘ λ³κ²½νμ¬ λͺ¨λ νμ μμΈλ₯Ό ν¬κ΄νμ¬ μμ νκ² λ¬΄μ(skip)νλλ‘ μμ νμμ΅λλ€.β Verification: λ³κ²½ μ¬νμ΄ λ°μλ ν
./gradlew clean test jacocoTestReport jacocoTestCoverageVerificationμ μ€ννμ¬ μλ‘κ² μΆκ°λ ν μ€νΈ μΌμ΄μ€(SentinelGlobTest)κ° ν΅κ³Όνκ³ ν μ€νΈ 컀λ²λ¦¬μ§κ° 100%λ‘ μ μ§λλ κ²μ νμΈνμμ΅λλ€.PR created automatically by Jules for task 15211205123441255329 started by @seonghobae