apache/dubbo

Test YamlCodec to ensure no CVE issue

Closed

#13,799 opened on Feb 26, 2024

View on GitHubContributor guide
 (4 comments) (0 reactions) (1 assignee)Java (26,453 forks)batch import
component/sdkgood first issuehelp wantedtype/discussion

Repository metrics

Stars
 (41,524 stars)
PR merge metrics
 (Avg merge 7d 14h) (20 merged PRs in 30d)

Description

Currently using loadAs to parse http message, need to add unit test ensure no CVE issue. as with JSON, not to enable any object deserialization.

Contributor guide

Research direction
The issue requests adding unit tests for YamlCodec to ensure no unsafe deserialization vulnerabilities. Look at the existing JSON codec tests for patterns (e.g., avoid enabling object deserialization). The main class to test is likely YamlCodec, located in the dubbo common module. The test should verify that loadAs does not allow arbitrary object deserialization, similar to JSON tests. Check the test directory for similar test cases and follow the same structure.
Tech stack
java
Domain
testingsecurity
Issue type
Test
DifficultyEstimated implementation difficulty for a new contributor, from 1 for very small changes to 5 for expert-level work.
2
Estimated timeA rough time range for an experienced contributor to investigate, implement, test, and prepare a pull request.
Under 1 hour
Activity statusHow available the issue appears right now: fresh, active, stale, blocked, or waiting on maintainer input.
Active
ClarityHow clearly the issue explains the expected change, acceptance criteria, and next step.
Clear
Prerequisites
JavaJUnitYAML parsingApache Dubbo basics
Newbie friendlinessA 1-100 score estimating how approachable this issue is for first-time contributors.
40