(openmeetings) branch master updated: [OPENMEETINGS-2830] crypt.class.name is validated while setting

[so...@apache.org]

This is an automated email from the ASF dual-hosted git repository.

solomax pushed a commit to branch master
in repository https://gitbox.apache.org/repos/asf/openmeetings.git


The following commit(s) were added to refs/heads/master by this push:
     new 33b88a85d [OPENMEETINGS-2830] crypt.class.name is validated while setting
33b88a85d is described below

commit 33b88a85d8af10d927319728b86d148d9dc0a464
Author: Maxim Solodovnik <so...@apache.org>
AuthorDate: Thu Aug 27 12:22:04 2026 +0700

    [OPENMEETINGS-2830] crypt.class.name is validated while setting
---
 .../db/dao/basic/ConfigurationDao.java             | 24 ++++++++++++++++++++++
 .../db/dao/calendar/AppointmentDao.java            |  2 +-
 2 files changed, 25 insertions(+), 1 deletion(-)

diff --git a/openmeetings-db/src/main/java/org/apache/openmeetings/db/dao/basic/ConfigurationDao.java b/openmeetings-db/src/main/java/org/apache/openmeetings/db/dao/basic/ConfigurationDao.java
index e23958c00..09a3f4008 100644
--- a/openmeetings-db/src/main/java/org/apache/openmeetings/db/dao/basic/ConfigurationDao.java
+++ b/openmeetings-db/src/main/java/org/apache/openmeetings/db/dao/basic/ConfigurationDao.java
@@ -25,6 +25,7 @@ import static org.apache.openmeetings.util.OpenmeetingsVariables.*;
 import static org.apache.wicket.csp.CSPDirectiveSrcValue.SELF;
 import static org.apache.wicket.csp.CSPDirectiveSrcValue.STRICT_DYNAMIC;
 
+import java.lang.reflect.Constructor;
 import java.net.UnknownHostException;
 import java.util.ArrayList;
 import java.util.Date;
@@ -49,6 +50,7 @@ import org.apache.openmeetings.db.dao.user.UserDao;
 import org.apache.openmeetings.db.entity.basic.Configuration;
 import org.apache.openmeetings.db.util.DaoHelper;
 import org.apache.openmeetings.util.crypt.CryptProvider;
+import org.apache.openmeetings.util.crypt.ICrypt;
 import org.apache.wicket.Application;
 import org.apache.wicket.csp.CSPDirective;
 import org.apache.wicket.csp.CSPHeaderConfiguration;
@@ -226,6 +228,28 @@ public class ConfigurationDao implements IDataProviderDao<Configuration> {
 	public Configuration update(Configuration entity, Long userId, boolean deleted) {
 		String key = entity.getKey();
 		String value = entity.getValue();
+		if (CONFIG_CRYPT.equals(key)) {
+			if (deleted) {
+				log.error("An attempt to delete '" + CONFIG_CRYPT + "' is blocked");
+				return entity;
+			}
+			boolean validClass = false;
+			try {
+				Class<?> clazz = Class.forName(value);
+				if (ICrypt.class.isAssignableFrom(clazz)) {
+					Constructor<?> constr = clazz.getDeclaredConstructor();
+					constr.setAccessible(true);
+					Object crypt = constr.newInstance();
+					validClass = crypt instanceof ICrypt;
+				}
+			} catch (Exception e) {
+				// no-op
+			}
+			if (!validClass) {
+				log.error("An attempt to set '" + value + "' as '" + CONFIG_CRYPT + "' is blocked");
+				return entity;
+			}
+		}
 		if (entity.getId() == null || entity.getId().longValue() <= 0) {
 			entity.setDeleted(deleted);
 			entity.setInserted(new Date());
diff --git a/openmeetings-db/src/main/java/org/apache/openmeetings/db/dao/calendar/AppointmentDao.java b/openmeetings-db/src/main/java/org/apache/openmeetings/db/dao/calendar/AppointmentDao.java
index 00e46918f..1d7cca6df 100644
--- a/openmeetings-db/src/main/java/org/apache/openmeetings/db/dao/calendar/AppointmentDao.java
+++ b/openmeetings-db/src/main/java/org/apache/openmeetings/db/dao/calendar/AppointmentDao.java
@@ -273,7 +273,7 @@ public class AppointmentDao implements IDataProviderDao<Appointment>{
 	 * @param calId Calendar Id of the Calendar Id to which the Appointments belong to.
 	 * @return Returns <code>-1</code> if the there was an error executing the query,
 	 * otherwise returns the number of updated rows.
-	 * as described here {@link jakarta.persistence.Query.#executeUpdate()}
+	 * as described here {@link jakarta.persistence.Query.executeUpdate()}
 	 */
 	public int deletebyCalendar(Long calId) {
 		return em.createNamedQuery("deleteAppointmentsbyCalendar", Appointment.class)