ExternalVendorCode/corda
1
0
Fork 0
mirror of https://github.com/corda/corda.git synced 2025-01-01 18:56:44 +00:00
Code Issues Actions 2 Packages Projects Releases Wiki Activity

Fix netty-codec-http

Browse Source
This commit is contained in:
rick.parker 2023-04-06 14:46:42 +01:00
parent edc0f6439e
commit 79abb8d7eb
3 changed files with 35 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

1
tools/aegis4j/build.gradle
View File

@ -34,6 +34,7 @@ dependencies {
testImplementation "com.google.guava:guava:$guava_version"
testImplementation "org.yaml:snakeyaml:1.33"
testImplementation "org.jetbrains.kotlin:kotlin-stdlib-jdk8:$kotlin_version"
testImplementation "io.netty:netty:3.10.5.Final"
}
sourceCompatibility = 8

31
tools/aegis4j/src/test/java/net/gredler/aegis4j/CVE_2019_16869.java Normal file
View File

@ -0,0 +1,31 @@
/* Copyright (c) 2022, Daniel Gredler. All rights reserved. */
package net.gredler.aegis4j;
import org.jboss.netty.handler.codec.http.HttpRequestDecoder;
import org.junit.jupiter.api.AfterAll;
import org.junit.jupiter.api.Test;
import static org.junit.jupiter.api.Assertions.assertEquals;
import static org.junit.jupiter.api.Assertions.fail;
/**
* Tests netty-codec-http blocking.
*/
public class CVE_2019_16869 {
@AfterAll
public static void uninstallAgent() throws Exception {
System.clearProperty("aegis4j.additional.args");
}
@Test
public void test() throws Exception {
TestUtils.installAgent("path=../resources/test/netty-mods.properties");
try {
new HttpRequestDecoder();
fail("Exception expected");
} catch (RuntimeException e) {
assertEquals("netty-codec-http HttpMessageDecoder blocked by aegis4j", e.getMessage());
}
}
}

3
tools/aegis4j/src/test/resources/netty-mods.properties Normal file
View File

@ -0,0 +1,3 @@
# format: <feature>.<class-name>.<method-name>=<replacement-code>
# CVE-2019-16869 - HttpObjectDecoder was called HttpMessageDecoder back then
NETTYHTTP.org.jboss.netty.handler.codec.http.HttpMessageDecoder.HttpMessageDecoder=throw new java.lang.RuntimeException("netty-codec-http HttpMessageDecoder blocked by aegis4j");