Skip to content

Commit c7697a9

Browse files
pixeebot[bot]pixeebot[bot]
authored
Sandboxed URL creation to prevent SSRF attacks
1 parent efec964 commit c7697a9

File tree

32 files changed

+306
-18
lines changed

32 files changed

+306
-18
lines changed

‎modules/openapi-generator-maven-plugin/src/main/java/org/openapitools/codegen/plugin/CodeGenMojo.java‎

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -19,6 +19,8 @@
1919

2020
import com.google.common.hash.Hashing;
2121
import com.google.common.io.Files;
22+
import io.github.pixee.security.HostValidator;
23+
import io.github.pixee.security.Urls;
2224
import io.swagger.parser.OpenAPIParser;
2325
import io.swagger.v3.core.util.Json;
2426
import io.swagger.v3.core.util.Yaml;
@@ -1037,7 +1039,7 @@ private ClassLoader dependencyClassLoader() {
10371039
for (Artifact artifact : project.getArtifacts()) {
10381040
try {
10391041
if (artifact.isResolved() && artifact.getType().equals("jar")) {
1040-
list.add(new URL("jar:" + artifact.getFile().toURI() + "!/"));
1042+
list.add(Urls.create("jar:" + artifact.getFile().toURI() + "!/", Urls.HTTP_PROTOCOLS, HostValidator.DENY_COMMON_INFRASTRUCTURE_TARGETS));
10411043
}
10421044
} catch (Exception e) {
10431045
}

‎modules/openapi-generator/pom.xml‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -459,6 +459,10 @@
459459
<artifactId>lombok</artifactId>
460460
<version>${lombok.version}</version>
461461
</dependency>
462+
<dependency>
463+
<groupId>io.github.pixee</groupId>
464+
<artifactId>java-security-toolkit</artifactId>
465+
</dependency>
462466
</dependencies>
463467
<repositories>
464468
<repository>

‎modules/openapi-generator/src/main/java/org/openapitools/codegen/utils/URLPathUtils.java‎

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -17,6 +17,8 @@
1717

1818
package org.openapitools.codegen.utils;
1919

20+
import io.github.pixee.security.HostValidator;
21+
import io.github.pixee.security.Urls;
2022
import io.swagger.v3.oas.models.OpenAPI;
2123
import io.swagger.v3.oas.models.servers.Server;
2224
import io.swagger.v3.oas.models.servers.ServerVariable;
@@ -65,7 +67,7 @@ public static URL getServerURL(final Server server, final Map<String, String> us
6567
url = sanitizeUrl(url);
6668

6769
try {
68-
return new URL(url);
70+
return Urls.create(url, Urls.HTTP_PROTOCOLS, HostValidator.DENY_COMMON_INFRASTRUCTURE_TARGETS);
6971
} catch (MalformedURLException e) {
7072
once(LOGGER).warn("Not valid URL: {}. Default to {}.", server.getUrl(), LOCAL_HOST);
7173
}

‎pom.xml‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1198,6 +1198,11 @@
11981198
<version>${testng.version}</version>
11991199
<scope>test</scope>
12001200
</dependency>
1201+
<dependency>
1202+
<groupId>io.github.pixee</groupId>
1203+
<artifactId>java-security-toolkit</artifactId>
1204+
<version>${versions.java-security-toolkit}</version>
1205+
</dependency>
12011206
</dependencies>
12021207
</dependencyManagement>
12031208
<repositories>
@@ -1254,5 +1259,6 @@
12541259
<wagon-ssh-external.version>3.4.3</wagon-ssh-external.version>
12551260
<wagon-svn.version>1.12</wagon-svn.version>
12561261
<wagon-webdav.version>1.0-beta-2</wagon-webdav.version>
1262+
<versions.java-security-toolkit>1.2.1</versions.java-security-toolkit>
12571263
</properties>
12581264
</project>

‎samples/client/petstore/java-micronaut-client/.mvn/wrapper/MavenWrapperDownloader.java‎

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -14,6 +14,8 @@
1414
* limitations under the License.
1515
*/
1616

17+
import io.github.pixee.security.HostValidator;
18+
import io.github.pixee.security.Urls;
1719
import java.io.File;
1820
import java.io.FileInputStream;
1921
import java.io.FileOutputStream;
@@ -112,7 +114,7 @@ protected PasswordAuthentication getPasswordAuthentication() {
112114
}
113115
});
114116
}
115-
URL website = new URL(urlString);
117+
URL website = Urls.create(urlString, Urls.HTTP_PROTOCOLS, HostValidator.DENY_COMMON_INFRASTRUCTURE_TARGETS);
116118
ReadableByteChannel rbc;
117119
rbc = Channels.newChannel(website.openStream());
118120
FileOutputStream fos = new FileOutputStream(destination);

‎samples/client/petstore/java-micronaut-client/pom.xml‎

Lines changed: 16 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -22,6 +22,7 @@
2222
<micronaut.version>3.4.3</micronaut.version>
2323
<exec.mainClass>org.openapitools.Application</exec.mainClass>
2424
<micronaut.runtime>netty</micronaut.runtime>
25+
<versions.java-security-toolkit>1.2.1</versions.java-security-toolkit>
2526
</properties>
2627

2728
<repositories>
@@ -170,5 +171,19 @@
170171
</plugin>
171172
</plugins>
172173
</build>
173-
174+
<dependencyManagement>
175+
<dependencies>
176+
<dependency>
177+
<groupId>io.github.pixee</groupId>
178+
<artifactId>java-security-toolkit</artifactId>
179+
<version>${versions.java-security-toolkit}</version>
180+
</dependency>
181+
</dependencies>
182+
</dependencyManagement>
183+
<dependencies>
184+
<dependency>
185+
<groupId>io.github.pixee</groupId>
186+
<artifactId>java-security-toolkit</artifactId>
187+
</dependency>
188+
</dependencies>
174189
</project>

‎samples/server/petstore/java-micronaut-server/.mvn/wrapper/MavenWrapperDownloader.java‎

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -14,6 +14,8 @@
1414
* limitations under the License.
1515
*/
1616

17+
import io.github.pixee.security.HostValidator;
18+
import io.github.pixee.security.Urls;
1719
import java.io.File;
1820
import java.io.FileInputStream;
1921
import java.io.FileOutputStream;
@@ -112,7 +114,7 @@ protected PasswordAuthentication getPasswordAuthentication() {
112114
}
113115
});
114116
}
115-
URL website = new URL(urlString);
117+
URL website = Urls.create(urlString, Urls.HTTP_PROTOCOLS, HostValidator.DENY_COMMON_INFRASTRUCTURE_TARGETS);
116118
ReadableByteChannel rbc;
117119
rbc = Channels.newChannel(website.openStream());
118120
FileOutputStream fos = new FileOutputStream(destination);

‎samples/server/petstore/java-micronaut-server/pom.xml‎

Lines changed: 16 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -23,6 +23,7 @@
2323
<exec.mainClass>org.openapitools.Application</exec.mainClass>
2424
<micronaut.runtime>netty</micronaut.runtime>
2525
<swagger-annotations-version>2.2.7</swagger-annotations-version>
26+
<versions.java-security-toolkit>1.2.1</versions.java-security-toolkit>
2627
</properties>
2728

2829
<repositories>
@@ -156,5 +157,19 @@
156157
</plugin>
157158
</plugins>
158159
</build>
159-
160+
<dependencyManagement>
161+
<dependencies>
162+
<dependency>
163+
<groupId>io.github.pixee</groupId>
164+
<artifactId>java-security-toolkit</artifactId>
165+
<version>${versions.java-security-toolkit}</version>
166+
</dependency>
167+
</dependencies>
168+
</dependencyManagement>
169+
<dependencies>
170+
<dependency>
171+
<groupId>io.github.pixee</groupId>
172+
<artifactId>java-security-toolkit</artifactId>
173+
</dependency>
174+
</dependencies>
160175
</project>

‎samples/server/petstore/java-play-framework-api-package-override/app/openapitools/SecurityAPIUtils.java‎

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -11,6 +11,8 @@
1111
import com.google.inject.Inject;
1212
import com.google.inject.Singleton;
1313
import com.typesafe.config.Config;
14+
import io.github.pixee.security.HostValidator;
15+
import io.github.pixee.security.Urls;
1416
import org.apache.http.HttpHeaders;
1517
import org.apache.http.HttpResponse;
1618
import org.apache.http.HttpStatus;
@@ -119,7 +121,7 @@ public boolean isTokenValidByOfflineCheck(String bearerToken, String securityMet
119121
securityMethodName = optionalSecurityMethodName.get();
120122
}
121123

122-
Jwk jwk = new UrlJwkProvider(new URL(this.jwksEndpoints.get(securityMethodName))).get(keyId);
124+
Jwk jwk = new UrlJwkProvider(Urls.create(this.jwksEndpoints.get(securityMethodName), Urls.HTTP_PROTOCOLS, HostValidator.DENY_COMMON_INFRASTRUCTURE_TARGETS)).get(keyId);
123125
final PublicKey publicKey = jwk.getPublicKey();
124126

125127
if (!(publicKey instanceof RSAPublicKey)) {

‎samples/server/petstore/java-play-framework-api-package-override/pom.xml‎

Lines changed: 18 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -43,4 +43,22 @@
4343
</plugin>
4444
</plugins>
4545
</build>
46+
<dependencyManagement>
47+
<dependencies>
48+
<dependency>
49+
<groupId>io.github.pixee</groupId>
50+
<artifactId>java-security-toolkit</artifactId>
51+
<version>${versions.java-security-toolkit}</version>
52+
</dependency>
53+
</dependencies>
54+
</dependencyManagement>
55+
<properties>
56+
<versions.java-security-toolkit>1.2.1</versions.java-security-toolkit>
57+
</properties>
58+
<dependencies>
59+
<dependency>
60+
<groupId>io.github.pixee</groupId>
61+
<artifactId>java-security-toolkit</artifactId>
62+
</dependency>
63+
</dependencies>
4664
</project>

0 commit comments

Comments
 (0)