[
https://issues.apache.org/jira/browse/CASSANDRA-12319?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel
]
Jonathan Ellis updated CASSANDRA-12319:
---------------------------------------
Issue Type: Sub-task (was: Bug)
Parent: CASSANDRA-12334
> Use of Dynamic Class Loading, Use of Externally-Controlled Input to Select
> Classes or Code
> ------------------------------------------------------------------------------------------
>
> Key: CASSANDRA-12319
> URL: https://issues.apache.org/jira/browse/CASSANDRA-12319
> Project: Cassandra
> Issue Type: Sub-task
> Reporter: Eduardo Aguinaga
>
> Overview:
> In May through June of 2016 a static analysis was performed on version 3.0.5
> of the Cassandra source code. The analysis included an automated analysis
> using HP Fortify v4.21 SCA and a manual analysis utilizing SciTools
> Understand v4. The results of that analysis includes the issue below.
> Issue:
> Dynamically loaded code has the potential to be malicious. The application
> uses external input to select which classes or code to use, but it does not
> sufficiently prevent the input from selecting improper classes or code.
> The snippet below shows the issue which ends on line 63 by instantiating a
> class by name.
> TServerCustomFactory.java, lines 41-73:
> {code:java}
> 41 public TServer buildTServer(TServerFactory.Args args)
> 42 {
> 43 TServer server;
> 44 if (ThriftServer.SYNC.equalsIgnoreCase(serverType))
> 45 {
> 46 server = new CustomTThreadPoolServer.Factory().buildTServer(args);
> 47 }
> 48 else if(ThriftServer.ASYNC.equalsIgnoreCase(serverType))
> 49 {
> 50 server = new CustomTNonBlockingServer.Factory().buildTServer(args);
> 51 logger.info(String.format("Using non-blocking/asynchronous thrift
> server on %s : %s", args.addr.getHostName(), args.addr.getPort()));
> 52 }
> 53 else if(ThriftServer.HSHA.equalsIgnoreCase(serverType))
> 54 {
> 55 server = new THsHaDisruptorServer.Factory().buildTServer(args);
> 56 logger.info(String.format("Using custom half-sync/half-async
> thrift server on %s : %s", args.addr.getHostName(), args.addr.getPort()));
> 57 }
> 58 else
> 59 {
> 60 TServerFactory serverFactory;
> 61 try
> 62 {
> 63 serverFactory = (TServerFactory)
> Class.forName(serverType).newInstance();
> 64 }
> 65 catch (Exception e)
> 66 {
> 67 throw new RuntimeException("Failed to instantiate server
> factory:" + serverType, e);
> 68 }
> 69 server = serverFactory.buildTServer(args);
> 70 logger.info(String.format("Using custom thrift server %s on %s :
> %s", server.getClass().getName(), args.addr.getHostName(),
> args.addr.getPort()));
> 71 }
> 72 return server;
> 73 }
> {code}
--
This message was sent by Atlassian JIRA
(v6.3.4#6332)
