#28848

dotCMS · Jul 18, 2024 · 3ee6b45 · 3ee6b45
1 parent 42572ce
commit 3ee6b45
Show file tree

Hide file tree

Showing 2 changed files with 65 additions and 6 deletions.
diff --git a/dotCMS/src/main/java/com/dotcms/util/xstream/XStreamHandler.java b/dotCMS/src/main/java/com/dotcms/util/xstream/XStreamHandler.java
@@ -1,5 +1,6 @@
 package com.dotcms.util.xstream;
 
+import java.util.regex.Pattern;
 import com.dotmarketing.util.Logger;
 import com.thoughtworks.xstream.XStream;
 import com.thoughtworks.xstream.io.xml.DomDriver;
@@ -33,14 +34,15 @@ public boolean shouldSerializeMember(final Class definedIn,
             }
         };
 
-        xstream.allowTypesByWildcard(new String[] {
-                "com.dotcms.**", "com.dotmarketing.**", "com.google.common.collect.**", "java.lang.**",
-                "java.util.**", "java.sql.**", "com.thoughtworks.xstream.mapper.**"
-        });
+        //Allow only the classes that are in the trusted list
+        xstream.allowTypesByWildcard(TrustedListMatcher.patterns);
 
         xstream.addPermission(aClass -> {
-            Logger.warn(aClass, aClass.getCanonicalName()
-                    + " should be included in the xstream white list");
+            //If the class is not in the trusted list, log a warning
+            if (!TrustedListMatcher.matches(aClass)) {
+                Logger.warn(aClass, aClass.getCanonicalName()
+                        + " should be included in the xstream trusted list");
+            }
             return true;
         });
 
@@ -55,4 +57,40 @@ public boolean shouldSerializeMember(final Class definedIn,
     public static XStream newXStreamInstance() {
         return newXStreamInstance(null);
     }
+
+    public static class TrustedListMatcher {
+
+        private TrustedListMatcher(){
+            //Private constructor to avoid instantiation
+        }
+
+        static final String[] patterns = {
+                "com.dotcms.**", "com.dotmarketing.**", "com.google.common.collect.**",
+                "java.lang.**",
+                "java.util.**", "java.sql.**", "com.thoughtworks.xstream.mapper.**"
+        };
+
+        private static final Pattern[] compiledPatterns = compilePatterns();
+
+        private static Pattern[] compilePatterns() {
+            final Pattern[] compiledPatterns = new Pattern[TrustedListMatcher.patterns.length];
+            for (int i = 0; i < TrustedListMatcher.patterns.length; i++) {
+                // Replace '**' with '.*' to match any subpackage or class
+                final String regex = TrustedListMatcher.patterns[i].replace("**", ".*");
+                compiledPatterns[i] = Pattern.compile(regex);
+            }
+            return compiledPatterns;
+        }
+
+        public static boolean matches(Class<?> clazz) {
+            String className = clazz.getName();
+            for (Pattern pattern : compiledPatterns) {
+                if (pattern.matcher(className).matches()) {
+                    return true;
+                }
+            }
+            return false;
+        }
+    }
+
 }
diff --git a/...ion/src/test/java/com/dotcms/enterprise/publishing/remote/handler/ContentHandlerTest.java b/...ion/src/test/java/com/dotcms/enterprise/publishing/remote/handler/ContentHandlerTest.java
@@ -2,11 +2,13 @@
 
 import static org.junit.Assert.assertNotNull;
 import static org.junit.Assert.assertTrue;
+import static org.junit.Assert.assertFalse;
 
 import com.dotcms.publisher.pusher.wrapper.ContentWrapper;
 import com.dotcms.test.util.FileTestUtil;
 import com.dotcms.util.IntegrationTestInitService;
 import com.dotcms.util.xstream.XStreamHandler;
+import com.dotcms.util.xstream.XStreamHandler.TrustedListMatcher;
 import com.dotmarketing.portlets.contentlet.model.Contentlet;
 import com.thoughtworks.xstream.XStream;
 import java.io.File;
@@ -46,5 +48,24 @@ public void Test_XStream_Deserializer() throws IOException {
         assertTrue(contentlet.isFileAsset());
     }
 
+    @Test
+    public void Test_TrustedListMatcher() {
+        // Classes that should match the patterns
+        Class<?> allowedClass1 = java.util.ArrayList.class;
+        Class<?> allowedClass2 = java.lang.String.class;
+        Class<?> allowedClass3 = com.google.common.collect.Lists.class;
+
+        // Classes that should not match the patterns
+        Class<?> disallowedClass1 = java.nio.file.Paths.class;
+        Class<?> disallowedClass2 = org.junit.jupiter.api.Test.class;
+
+        // Verifications
+        assertTrue(TrustedListMatcher.matches(allowedClass1));
+        assertTrue(TrustedListMatcher.matches(allowedClass2));
+        assertTrue(TrustedListMatcher.matches(allowedClass3));
+
+        assertFalse(TrustedListMatcher.matches(disallowedClass1));
+        assertFalse(TrustedListMatcher.matches(disallowedClass2));
+    }
 
 }