jprdonnelly/tcommon-studio-se
Archived
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

fix(TDI-48203): [CVE]: routines.system.JSONObject(Object bean) use reflect to call method invoke, that's dangerous for evil script inject (#5426)

Browse Source
This commit is contained in:
wang wei
2022-07-27 09:29:03 +08:00
committed by wwang
parent 55aa8236ba
commit e16c7e1af3
3 changed files with 62 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files

15
main/plugins/org.talend.librariesmanager/resources/java/routines/system/ResumeUtil.java
View File

@@ -359,13 +359,12 @@ public class ResumeUtil {
String str = out.toString();
return str;
}
// to support encrypt the password in the resume
public static String convertToJsonText(Object context, List<String> parametersToEncrypt) {
public static String convertToJsonText(Object context, Class<?> expectedClass, List<String> parametersToEncrypt) {
String jsonText = "";
try {
JSONObject firstNode = new JSONObject();
JSONObject secondNode = new JSONObject(context);
JSONObject secondNode = new JSONObject(context, expectedClass);
if (parametersToEncrypt != null) {
for (String parameterToEncrypt : parametersToEncrypt) {
if (secondNode.isNull(parameterToEncrypt)) {
@@ -385,9 +384,15 @@ public class ResumeUtil {
return jsonText;
}
// to support encrypt the password in the resume
@Deprecated
public static String convertToJsonText(Object context, List<String> parametersToEncrypt) {
return convertToJsonText(context, context == null ? null : context.getClass(), parametersToEncrypt);
}
// Util: convert the context variable to json style text.
// feature:11296
// @Deprecated
@Deprecated
public static String convertToJsonText(Object context) {
return convertToJsonText(context, null);
}