opensource/graylog2-server
1
0
Fork 0
mirror of https://github.com/Graylog2/graylog2-server.git synced 2026-03-13 09:32:21 +08:00
Code Issues Packages Projects Releases Wiki Activity

Restrict classes allowed for cluster config and event types (#18165)

Browse Source 
Add a new safe_classes configuration option to restrict the classes allowed to be used
as cluster config and event types.
The configuration option allows to specify a comma-separated set of prefixes matched
against the fully qualified class name.

For now, the default value for the configuration is org.graylog.,org.graylog2., which will
allow all classes that Graylog maintains.

This should work out of the box for almost all setups. Changing the default value might
only be necessary if external plugins require cluster config or event types outside the
"org.graylog." or "org.graylog2." namespaces. If that is the case, the configuration setting
can be adjusted to cover this use case, e.b. by setting it to

    safe_classes = org.graylog.,org.graylog2.,custom.plugin.namespace.

if said classes are located within the custom.plugin.namespace package.

Refs: https://github.com/Graylog2/graylog2-server/security/advisories/GHSA-p6gg-5hf4-4rgj
This commit is contained in:
Othello Maurer
2024-02-06 15:34:55 +01:00
committed by GitHub
parent f273373c4e
commit 813203263b
16 changed files with 426 additions and 29 deletions
Download Patch File Download Diff File Expand all files Collapse all files

11
data-node/src/main/java/org/graylog/datanode/Configuration.java
View File

@@ -23,6 +23,7 @@ import com.github.joschi.jadconfig.Validator;
import com.github.joschi.jadconfig.ValidatorMethod;
import com.github.joschi.jadconfig.converters.IntegerConverter;
import com.github.joschi.jadconfig.converters.StringListConverter;
import com.github.joschi.jadconfig.converters.StringSetConverter;
import com.github.joschi.jadconfig.util.Duration;
import com.github.joschi.jadconfig.validators.PositiveIntegerValidator;
import com.github.joschi.jadconfig.validators.StringNotBlankValidator;
@@ -31,6 +32,7 @@ import com.google.common.annotations.VisibleForTesting;
import com.google.common.net.InetAddresses;
import org.graylog.datanode.configuration.BaseConfiguration;
import org.graylog.datanode.configuration.DatanodeDirectories;
import org.graylog2.Configuration.SafeClassesValidator;
import org.graylog2.plugin.Tools;
import org.graylog2.shared.SuppressForbidden;
import org.joda.time.DateTimeZone;
@@ -50,6 +52,7 @@ import java.nio.file.Paths;
import java.util.Collections;
import java.util.List;
import java.util.Optional;
import java.util.Set;
/**
* Helper class to hold configuration of Graylog
@@ -213,9 +216,15 @@ public class Configuration extends BaseConfiguration {
@Parameter(value = "http_allow_embedding")
private boolean httpAllowEmbedding = false;
/**
* Classes considered safe to load by name. A set of prefixes matched against the fully qualified class name.
*/
@Parameter(value = org.graylog2.Configuration.SAFE_CLASSES, converter = StringSetConverter.class, validators = SafeClassesValidator.class)
private Set<String> safeClasses = Set.of("org.graylog.", "org.graylog2.");
@Parameter(value = "metrics_timestamp")
private String metricsTimestamp = "timestamp";
@Parameter(value = "metrics_stream")
private String metricsStream = "gl-datanode-metrics";