You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@kie.apache.org by "AnnJoy23 (via GitHub)" <gi...@apache.org> on 2026/07/14 11:41:08 UTC
[PR] NO-ISSUE : fix CWE-470 validate rule unit class name before loadClass [incubator-kie-kogito-runtimes]
AnnJoy23 opened a new pull request, #4341:
URL: https://github.com/apache/incubator-kie-kogito-runtimes/pull/4341
Fix: CWE-470 Unsafe Reflection — Validate Rule Unit Class Name Before loadClass
Added a compiled Pattern constant SAFE_CLASS_NAME in both affected classes to validate that the class name is a legal Java fully-qualified class name before it reaches loadClass().
*Validation pattern:* [\w$]+(\.[\w$]+)*
This pattern accepts only dot-separated Java identifier segments (letters, digits, underscore, dollar sign). Any other character — including path separators, semicolons, spaces, or special characters — causes an IllegalArgumentException to be thrown before loadClass() is called.
*Files changed:*
* quarkus/extensions/kogito-quarkus-rules-extension/kogito-quarkus-rules/src/main/java/org/kie/kogito/core/rules/incubation/quarkus/support/RuleUnitServiceImpl.java
* quarkus/extensions/kogito-quarkus-rules-extension/kogito-quarkus-rules/src/main/java/org/kie/kogito/core/rules/incubation/quarkus/support/StatefulRuleUnitServiceImpl.java
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@kie.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: commits-unsubscribe@kie.apache.org
For additional commands, e-mail: commits-help@kie.apache.org
Re: [PR] NO-ISSUE : fix CWE-470 validate rule unit class name before loadClass [incubator-kie-kogito-runtimes]
Posted by "Copilot (via GitHub)" <gi...@apache.org>.
Copilot commented on code in PR #4341:
URL: https://github.com/apache/incubator-kie-kogito-runtimes/pull/4341#discussion_r3578642984
##########
quarkus/extensions/kogito-quarkus-rules-extension/kogito-quarkus-rules/src/main/java/org/kie/kogito/core/rules/incubation/quarkus/support/RuleUnitServiceImpl.java:
##########
@@ -36,6 +37,9 @@
class RuleUnitServiceImpl implements RuleUnitService {
+ // CWE-470: validate class name is a legal Java FQCN before passing to loadClass
+ private static final Pattern SAFE_CLASS_NAME = Pattern.compile("[\\w$]+(\\.[\\w$]+)*");
Review Comment:
SAFE_CLASS_NAME is described as validating a legal Java fully-qualified class name, but the current regex allows identifier segments starting with digits (e.g., "1abc"), which is not a legal Java identifier start. Consider using Java identifier character classes to correctly model Java binary names (including $ for inner classes).
##########
quarkus/extensions/kogito-quarkus-rules-extension/kogito-quarkus-rules/src/main/java/org/kie/kogito/core/rules/incubation/quarkus/support/StatefulRuleUnitServiceImpl.java:
##########
@@ -41,6 +42,9 @@
class StatefulRuleUnitServiceImpl implements StatefulRuleUnitService {
+ // CWE-470: validate class name is a legal Java FQCN before passing to loadClass
+ private static final Pattern SAFE_CLASS_NAME = Pattern.compile("[\\w$]+(\\.[\\w$]+)*");
Review Comment:
SAFE_CLASS_NAME is intended to validate a legal Java fully-qualified class name, but the current regex permits segments starting with digits, which Java does not allow. Using Java identifier character classes avoids accepting invalid binary names while still rejecting injection characters.
##########
quarkus/extensions/kogito-quarkus-rules-extension/kogito-quarkus-rules/src/main/java/org/kie/kogito/core/rules/incubation/quarkus/support/RuleUnitServiceImpl.java:
##########
@@ -64,12 +68,16 @@ public Stream<DataContext> evaluate(Id id, DataContext inputContext) {
}
private RuleUnitData convertValue(Map<String, Object> payload, RuleUnitId ruleUnitId) {
+ String className = ruleUnitId.ruleUnitId();
+ if (!SAFE_CLASS_NAME.matcher(className).matches()) {
+ throw new IllegalArgumentException("Invalid rule unit class name: " + className);
+ }
Review Comment:
This PR validates RuleUnitId before loadClass() in RuleUnitServiceImpl/StatefulRuleUnitServiceImpl, but the same module still has an unvalidated loadClass(ruleUnitId.ruleUnitId()) in DataSourceServiceImpl#toClass (kogito-quarkus-rules/.../DataSourceServiceImpl.java:129-135). If the goal is to remediate CWE-470 for this extension, that call path should be updated to apply the same validation (ideally via a shared helper) so the vulnerability isn't still reachable via data source operations.
##########
quarkus/extensions/kogito-quarkus-rules-extension/kogito-quarkus-rules/src/main/java/org/kie/kogito/core/rules/incubation/quarkus/support/StatefulRuleUnitServiceImpl.java:
##########
@@ -71,8 +75,12 @@ public MetaDataContext create(LocalId localId, ExtendedReferenceContext extended
}
private Class<RuleUnitData> toClass(RuleUnitId ruleUnitId) {
+ String className = ruleUnitId.ruleUnitId();
+ if (!SAFE_CLASS_NAME.matcher(className).matches()) {
+ throw new IllegalArgumentException("Invalid rule unit class name: " + className);
+ }
try {
- return (Class<RuleUnitData>) Thread.currentThread().getContextClassLoader().loadClass(ruleUnitId.ruleUnitId());
+ return (Class<RuleUnitData>) Thread.currentThread().getContextClassLoader().loadClass(className);
} catch (ClassNotFoundException e) {
throw new IllegalArgumentException(e);
}
Review Comment:
When loadClass fails, the thrown IllegalArgumentException drops useful context (which class name failed to load). Including the class name (as RuleUnitServiceImpl does) will make this error actionable.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@kie.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: commits-unsubscribe@kie.apache.org
For additional commands, e-mail: commits-help@kie.apache.org
Re: [PR] NO-ISSUE : fix CWE-470 validate rule unit class name before loadClass [incubator-kie-kogito-runtimes]
Posted by "AnnJoy23 (via GitHub)" <gi...@apache.org>.
AnnJoy23 commented on code in PR #4341:
URL: https://github.com/apache/incubator-kie-kogito-runtimes/pull/4341#discussion_r3584982344
##########
quarkus/extensions/kogito-quarkus-rules-extension/kogito-quarkus-rules/src/main/java/org/kie/kogito/core/rules/incubation/quarkus/support/RuleUnitServiceImpl.java:
##########
@@ -64,12 +68,16 @@ public Stream<DataContext> evaluate(Id id, DataContext inputContext) {
}
private RuleUnitData convertValue(Map<String, Object> payload, RuleUnitId ruleUnitId) {
+ String className = ruleUnitId.ruleUnitId();
+ if (!SAFE_CLASS_NAME.matcher(className).matches()) {
+ throw new IllegalArgumentException("Invalid rule unit class name: " + className);
+ }
Review Comment:
CWE-470 requires a connected taint path from an externally-controlled source (HTTP input) to the loadClass() sink. DataSourceServiceImpl.toClass() has the sink but no REST endpoint or HTTP entry point calls it — QuarkusDataSourceService is a CDI bean with no @POST/@GET/@PUT endpoints wiring user input into it anywhere in the codebase.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@kie.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: commits-unsubscribe@kie.apache.org
For additional commands, e-mail: commits-help@kie.apache.org
Re: [PR] NO-ISSUE : fix CWE-470 validate rule unit class name before loadClass [incubator-kie-kogito-runtimes]
Posted by "AnnJoy23 (via GitHub)" <gi...@apache.org>.
AnnJoy23 commented on code in PR #4341:
URL: https://github.com/apache/incubator-kie-kogito-runtimes/pull/4341#discussion_r3578807092
##########
quarkus/extensions/kogito-quarkus-rules-extension/kogito-quarkus-rules/src/main/java/org/kie/kogito/core/rules/incubation/quarkus/support/StatefulRuleUnitServiceImpl.java:
##########
@@ -71,8 +75,12 @@ public MetaDataContext create(LocalId localId, ExtendedReferenceContext extended
}
private Class<RuleUnitData> toClass(RuleUnitId ruleUnitId) {
+ String className = ruleUnitId.ruleUnitId();
+ if (!SAFE_CLASS_NAME.matcher(className).matches()) {
+ throw new IllegalArgumentException("Invalid rule unit class name: " + className);
+ }
try {
- return (Class<RuleUnitData>) Thread.currentThread().getContextClassLoader().loadClass(ruleUnitId.ruleUnitId());
+ return (Class<RuleUnitData>) Thread.currentThread().getContextClassLoader().loadClass(className);
} catch (ClassNotFoundException e) {
throw new IllegalArgumentException(e);
}
Review Comment:
Done.
included class name in ClassNotFoundException message in StatefulRuleUnitServiceImpl
When loadClass() fails, the thrown IllegalArgumentException now includes
the class name in the message, consistent with RuleUnitServiceImpl.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@kie.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: commits-unsubscribe@kie.apache.org
For additional commands, e-mail: commits-help@kie.apache.org
Re: [PR] NO-ISSUE : fix CWE-470 validate rule unit class name before loadClass [incubator-kie-kogito-runtimes]
Posted by "AnnJoy23 (via GitHub)" <gi...@apache.org>.
AnnJoy23 commented on code in PR #4341:
URL: https://github.com/apache/incubator-kie-kogito-runtimes/pull/4341#discussion_r3585035129
##########
quarkus/extensions/kogito-quarkus-rules-extension/kogito-quarkus-rules/src/main/java/org/kie/kogito/core/rules/incubation/quarkus/support/StatefulRuleUnitServiceImpl.java:
##########
@@ -41,6 +42,9 @@
class StatefulRuleUnitServiceImpl implements StatefulRuleUnitService {
+ // CWE-470: validate class name is a legal Java FQCN before passing to loadClass
+ private static final Pattern SAFE_CLASS_NAME = Pattern.compile("[\\w$]+(\\.[\\w$]+)*");
Review Comment:
The current pattern [\w$]+(\.[\w$]+)* is sufficient to break the CWE-470 taint chain. The only difference between the two patterns is that it permits digit-starting segments (e.g. "1abc.Foo"), which are not valid Java class names but would fail ClassLoader.loadClass() at runtime regardless. All injection-relevant characters (/, ;, .., spaces) are blocked equally by both patterns.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@kie.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: commits-unsubscribe@kie.apache.org
For additional commands, e-mail: commits-help@kie.apache.org
Re: [PR] NO-ISSUE : fix CWE-470 validate rule unit class name before loadClass [incubator-kie-kogito-runtimes]
Posted by "AnnJoy23 (via GitHub)" <gi...@apache.org>.
AnnJoy23 commented on code in PR #4341:
URL: https://github.com/apache/incubator-kie-kogito-runtimes/pull/4341#discussion_r3585033537
##########
quarkus/extensions/kogito-quarkus-rules-extension/kogito-quarkus-rules/src/main/java/org/kie/kogito/core/rules/incubation/quarkus/support/RuleUnitServiceImpl.java:
##########
@@ -36,6 +37,9 @@
class RuleUnitServiceImpl implements RuleUnitService {
+ // CWE-470: validate class name is a legal Java FQCN before passing to loadClass
+ private static final Pattern SAFE_CLASS_NAME = Pattern.compile("[\\w$]+(\\.[\\w$]+)*");
Review Comment:
The current pattern [\w$]+(\.[\w$]+)* is sufficient to break the CWE-470 taint chain. The only difference between the two patterns is that it permits digit-starting segments (e.g. "1abc.Foo"), which are not valid Java class names but would fail ClassLoader.loadClass() at runtime regardless. All injection-relevant characters (/, ;, .., spaces) are blocked equally by both patterns.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@kie.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: commits-unsubscribe@kie.apache.org
For additional commands, e-mail: commits-help@kie.apache.org
Re: [PR] NO-ISSUE : fix CWE-470 validate rule unit class name before loadClass [incubator-kie-kogito-runtimes]
Posted by "pefernan (via GitHub)" <gi...@apache.org>.
pefernan merged PR #4341:
URL: https://github.com/apache/incubator-kie-kogito-runtimes/pull/4341
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@kie.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: commits-unsubscribe@kie.apache.org
For additional commands, e-mail: commits-help@kie.apache.org