BitoAgent commented on code in PR #13786:
URL: https://github.com/apache/dubbo/pull/13786#discussion_r1573356166
##########
dubbo-remoting/dubbo-remoting-http12/src/main/java/org/apache/dubbo/remoting/http12/message/LengthFieldStreamingDecoder.java:
##########
@@ -167,8 +160,8 @@ private void processBody() throws IOException {
requiredLength = lengthFieldOffset + lengthFieldLength;
}
- protected void invokeListener(InputStream inputStream) {
- this.listener.onFragmentMessage(dataHeader, inputStream);
+ public void invokeListener(InputStream inputStream) {
+ this.listener.onFragmentMessage(inputStream);
Review Comment:
**Security Issue**: Changing the visibility of the invokeListener method
from protected to public without proper validation can expose internal
processing mechanisms to unintended usage, potentially leading to unauthorized
access or denial of service. <br> **Fix**: Reinstate the method's protected
visibility and ensure that any external calls to this method are properly
authenticated and validated to prevent unauthorized access. <br> **Code
Suggestion**:
```
- protected void invokeListener(InputStream inputStream) {
+ private void invokeListener(InputStream inputStream) {
```
##########
dubbo-rpc/dubbo-rpc-triple/src/main/java/org/apache/dubbo/rpc/protocol/tri/h12/grpc/GrpcRequestHandlerMapping.java:
##########
@@ -42,9 +43,16 @@ protected boolean supportContentType(String contentType) {
@Override
protected void determineHttpMessageCodec(RequestHandler handler, URL url,
HttpRequest request) {
- HttpMessageCodec codec = CODEC_FACTORY.createCodec(url,
getFrameworkModel(), request.contentType());
- handler.setHttpMessageDecoder(codec);
- handler.setHttpMessageEncoder(codec);
+ GrpcCompositeCodec grpcCompositeCodec =
+ (GrpcCompositeCodec) CODEC_FACTORY.createCodec(url,
getFrameworkModel(), request.contentType());
+ MethodDescriptor methodDescriptor =
DescriptorUtils.findMethodDescriptor(
+ handler.getServiceDescriptor(), handler.getMethodName(),
handler.isHasStub());
+ if (methodDescriptor != null) {
+ handler.setMethodDescriptor(methodDescriptor);
+ grpcCompositeCodec.loadPackableMethod(methodDescriptor);
Review Comment:
**Security Issue**: The code dynamically loads a MethodDescriptor based on
request data without proper validation, potentially allowing for unauthorized
method execution or access control bypass. <br> **Fix**: Implement strict
validation of the request data used to find the MethodDescriptor. Ensure that
the method access is authorized for the requesting user before setting the
MethodDescriptor. <br> **Code Suggestion**:
```
Integrate strict request data validation before loading the
MethodDescriptor to ensure only authorized access. Include checks for user
authorization in relation to the requested MethodDescriptor.
```
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
