Re: Checking list health
Rolf Lear <[email protected]> Thu, 22 Jan 2015 13:33:50 -0500
| Newsgroups | gmane.comp.java.jdom.general |
|---|---|
| Message-ID | <[email protected]> |
Here's more detail on the IBM security audit: In late 2013 IBM contacted the mailing list here: http://markmail.org/message/ufvpxiblhcgdlpoc We responded to them, and got the full report of the vulnerabilities they had identified in JDOM. This scan was done as part of IBM's standard processes when using open source software, and part of their commitment to the open source community. JDOM 2.0.5 ========== They identified 2 basic issues in JDOM 2.0.5 appearing in a number of different places: Vulnerability CWE Link Severity API Call Line Number Trace (right click->Show/Hide Comments to view) File Containing Vulnerability PathTraversal Weakness ID: 73 HIGH java.io.File.<init> 180 Trace in comment C:\jdom\2.0.5\Java\org\jdom2\contrib\beans\JDOMBean.java PathTraversal Weakness ID: 73 HIGH java.io.File.<init> 236 Trace in comment C:\jdom\2.0.5\Java\org\jdom2\contrib\beans\JDOMBean.java PrivilegeEscalation Weakness ID: 266 MEDIUM java.lang.reflect.Method.invoke 1357 Trace in comment C:\jdom\2.0.5\Java\org\jdom2\test\cases\output\AbstractTestOutputter.java PrivilegeEscalation Weakness ID: 266 MEDIUM java.lang.reflect.Method.invoke 1357 Trace in comment C:\jdom\2.0.5\Java\org\jdom2\test\cases\output\AbstractTestOutputter.java PrivilegeEscalation Weakness ID: 266 MEDIUM java.lang.reflect.Method.invoke 1357 Trace in comment C:\jdom\2.0.5\Java\org\jdom2\test\cases\output\AbstractTestOutputter.java PrivilegeEscalation Weakness ID: 266 MEDIUM java.lang.reflect.Method.invoke 1357 Trace in comment C:\jdom\2.0.5\Java\org\jdom2\test\cases\output\AbstractTestOutputter.java (... and 38 additional places where AbstractTestOutputter had the same reflection problem). I consider these issues to be 'mostly' benign. The "HIGH severity" JDOMBean file problem is in the Contrib area of JDOM, and not in the core. The actual vulnerability is because it has a static File instance which is vulnerable in places where the JVM is compromized and someone 'hacks' the static location, leading to the loading of unexpected content. I resolved the issue in this commit: https://github.com/hunterhacker/jdom/commit/c0f7b99d953730413da41ccc8028cd7120e45ec2 (which was duplicated in the master branch too). The fix I employed was simply to remove the instance field, and be done with it. It is unsupported code, and for example purposes only. This was a decision made for the 2.x release, that contrib was completely unsupported. The remaining issues in 2.0.5 are related to a reflection hack I did in the JUnit test cases to help 'simplify' the harness. The fix I employed was to rename the methods that were otherwise called with reflection, and instead call the methods directly by name. You can see the fix here: https://github.com/hunterhacker/jdom/commit/7cb87783b7d023dcfa77f742fe29bfe6b8be220b Again, this issue is minor - it is in the JUnit test cases, and has been resolved without impact at all. Note that although these fixes are in the source code, there has not been a release of JDOM 2.x since then. These fixes will not impact any code that is shipped. The code is not in maven, nor in the binary distribution. It is in the support code only. Older versions ============== In addition to testing JDOM 2.0.5, they also tested 1.1.2 and 1.0. The 1.0 version has the same issues as 1.1.2. JDOM 1.1.2 has the following identified issues: Potential privilidge escalation in JDOMException when reporting the parent exception: https://github.com/hunterhacker/jdom/blob/jdom-1.x/core/src/java/org/jdom/JDOMException.java#L353 Similarly here: https://github.com/hunterhacker/jdom/blob/jdom-1.x/core/src/java/org/jdom/JDOMException.java#L328 Note that the above code is not in JDOM 2.x at all, and relates to the history of Java where the cause of exceptions was not part of the Java API. The final issues in JDOM 1.1.2 is related to the use of reflection to identify and early Java versions without JAXP: java.lang.reflect.Method.invoke 104 C:\jdom\1.1.2\Java\src\java\org\jdom\adapters\CrimsonDOMAdapter.java java.lang.reflect.Method.invoke 616 C:\jdom\1.1.2\Java\src\java\org\jdom\input\SAXBuilder.java java.lang.reflect.Method.invoke 460 C:\jdom\1.1.2\Java\src\java\org\jdom\output\Format.java The code links are: https://github.com/hunterhacker/jdom/blob/jdom-1.x/core/src/java/org/jdom/adapters/CrimsonDOMAdapter.java#L104 https://github.com/hunterhacker/jdom/blob/jdom-1.x/core/src/java/org/jdom/input/SAXBuilder.java#L616 https://github.com/hunterhacker/jdom/blob/jdom-1.x/core/src/java/org/jdom/output/Format.java#L460 Note that the Format issue related to needing to compile 1.1.x on old versions of Java (1.2, and 1.3) which did not have the NIO Charset classes. Rolf. On 2015-01-22 11:48, Scott LaChance wrote: > The IBM security audit sounds interesting. Can some elaborate on > that. > > Sent from my iPhone > >> On Jan 22, 2015, at 10:46 AM, Rolf Lear <[email protected]> wrote: >> >> I am overdue on a couple of things JDOM related. >> >> let's be clear, even though Cecil says: "And the code must be >> working perfectly :-)", given the volume of downloads, that is close >> to accurate. JDOM is currently very successful. >> >> Here's a hit list of things which I believe should be done: >> >> 1. Year-in-review update on some of the events that have happened: >> - Eclipse inclusion >> - IBM security audit >> - tutorial sites and FAQ translations >> - Java8 bugs >> - statistics of downloads and other activities from Maven, etc. >> 2. Plan for Java 8 nice-to-haves >> - direct JDOM 2.1 for Java8 support of streams, other niceties >> 3. XML 1.1 character validation >> 4. XPath 2.0 (Saxon support?) - xalan has gone fairly quiet >> >> As for feedback, the JDOM interest list has been quiet, but >> StackOverflow activity has been slow-but-steady. People are using >> JDOM. 190 questions asked in 2014 for JDOM: >> http://stackoverflow.com/search?q=created%3A2014+[jdom]+or+[jdom-2] >> >> Unfortunately, a lot of the usage is still on 1.x versions, about >> 50% of questions on StackOverflow are for older versions. >> >> Jason can maybe provide statistics for the base server downloads, >> but maven-central has seen the following (lets see if these links >> work... - if they don't I will respond later): >> >> >> http://chart.apis.google.com/chart?cht=lc&chs=800x200&chco=326A9E&chxt=x,y&chtt=Downloads+Over+the+Last+12+Months+For+org.jdom&chxr=1,0,174133&chds=0,174133&chxs=1N*s*&chls=3&chm=o,0066FF,0,-1,10,0&chd=t:99538,103678,112177,111238,144999,135498,146573,138067,139843,135834,164626,174133&chxl=0:|Jan2014|Feb2014|Mar2014|Apr2014|May2014|Jun2014|Jul2014|Aug2014|Sep2014|Oct2014|Nov2014|Dec2014 >> >> This download activity can be presented in the form of unique ID's >> too: >> >> >> http://chart.apis.google.com/chart?cht=lc&chs=800x200&chco=326A9E&chxt=x,y&chtt=Unique%20IPs+Over+the+Last+12+Months+For+org.jdom:jdom&chxr=1,0,65408&chds=0,65408&chxs=1N*s*&chls=3&chm=o,0066FF,0,-1,10,0&chd=t:34454,37307,41365,39342,43554,46225,50756,48704,27497,23741,57305,65408&chxl=0:|Jan2014|Feb2014|Mar2014|Apr2014|May2014|Jun2014|Jul2014|Aug2014|Sep2014|Oct2014|Nov2014|Dec2014 >> >> >> >> Downloads broken down by versions >> >> JDOM 1.x: >> >> >> http://chart.apis.google.com/chart?cht=lc&chs=800x200&chco=326A9E&chxt=x,y&chtt=Downloads+Over+the+Last+12+Months+For+org.jdom:jdom&chxr=1,0,156557&chds=0,156557&chxs=1N*s*&chls=3&chm=o,0066FF,0,-1,10,0&chd=t:84755,89410,96793,94324,104023,108547,124381,124479,125471,120968,147666,156557&chxl=0:|Jan2014|Feb2014|Mar2014|Apr2014|May2014|Jun2014|Jul2014|Aug2014|Sep2014|Oct2014|Nov2014|Dec2014 >> >> JDOM 2.x >> >> >> http://chart.apis.google.com/chart?cht=lc&chs=800x200&chco=326A9E&chxt=x,y&chtt=Downloads+Over+the+Last+12+Months+For+org.jdom:jdom2&chxr=1,0,34490&chds=0,34490&chxs=1N*s*&chls=3&chm=o,0066FF,0,-1,10,0&chd=t:12473,12092,12384,13980,34490,25304,20254,11196,11922,12315,14194,15143&chxl=0:|Jan2014|Feb2014|Mar2014|Apr2014|May2014|Jun2014|Jul2014|Aug2014|Sep2014|Oct2014|Nov2014|Dec2014 >> >> With 2.0.5 specifically being: >> >> >> http://chart.apis.google.com/chart?cht=lc&chs=800x200&chco=326A9E&chxt=x,y&chtt=Downloads+Over+the+Last+12+Months+For+org.jdom:jdom2:2.0.5&chxr=1,0,32129&chds=0,32129&chxs=1N*s*&chls=3&chm=o,0066FF,0,-1,10,0&chd=t:10330,9968,9832,11321,32129,22974,17695,8217,9039,9689,11355,12529&chxl=0:|Jan2014|Feb2014|Mar2014|Apr2014|May2014|Jun2014|Jul2014|Aug2014|Sep2014|Oct2014|Nov2014|Dec2014 >> >> The bottom line is that form maven only, cumulatively, there have >> been about 200,000 downloads of JDOM 2.0.5 >> >> Rolf >> >>> On 2015-01-22 01:19, Jason Hunter wrote: >>> Just wondering if the list is alive. :) >>> >>> -jh- >>> >>> _______________________________________________ >>> To control your jdom-interest membership: >>> >>> http://www.jdom.org/mailman/options/jdom-interest/[email protected] >> >> _______________________________________________ >> To control your jdom-interest membership: >> >> http://www.jdom.org/mailman/options/jdom-interest/[email protected] _______________________________________________ To control your jdom-interest membership: http://www.jdom.org/mailman/options/jdom-interest/[email protected]