Re: Freemarker Sandboxing

Monday, June 16, 2008, 10:08:17 PM, Attila Szegedi wrote:

> On 2008.06.16., at 19:53, Daniel Dekany wrote:
>
>>>> or
>>>> create arbitrary objects.
>>>
>>> It does have a ?new built-in, but it can only create objects that
>>> implement the TemplateModel interface.
>>
>> (With the same logic as above, this also up to the Web Application
>> Framework.)
>
> Well, yes, theoretically if the webapp contains some special purpose  
> class that also implements TemplateModel (i.e. custom methods), this  
> could be exploited. However, combined with Java security policy that  
> disallows access to classes in implementation-specific packages, it  
> can be mitigated. Or simply by making these classes package-private; ?
> new built-in can only instantiate public classes.

I meant that if someone wants to allow creating arbitrary objects from
FTL, it's possible like, for example,
myCustomFactoryMethod("ClassName"), as much as the Java platform makes
it possible. But of course, the "problem" of the asker was the
opposite here, so whatever...

> Also, since you can't isolate memory usage of different users within  
> the same JVM, someone can craft a webpage that concatenates a sequence
> in an infinite loop, eventually causing OutOfMemoryError on other  
> threads, or just increasing memory pressure on the server to ruin its
> performance. That's one thing you can't guard against...

Or by sending more and more HTTP requests, and not printing anything
in the core of the loop (so the Writer can't time out and throw
exception), you can eat up all practically available CPU time or the
thread pool capacity. These are *kind of* DOS attacks... and as
usually there is no ultimate answer for that kind of problems. But
yeah, it's a far too effective DOS attack; you don't even need a whole
army of zombies for it, just one computer.

> Attila.

-- 
Best regards,
 Daniel Dekany


-------------------------------------------------------------------------
Check out the new SourceForge.net Marketplace.
It's the best place to buy or sell services for
just about anything Open Source.
http://sourceforge.net/services/buy/index.php