jackson-deserialization-validation

Files (1)

• SKILL.md

SKILL.md (first lines)

# Jackson Deserialization Validation

## Vulnerability Pattern

When Jackson deserializes JSON with unknown properties, if not handled properly, malicious extra properties can bypass validation logic:

```json
{
  "validProperty": "legitimate value",
  "": {
    "enabled": true,
    "other": "malicious"
  }
}
```

The empty key `""` can be overlooked by simple property checks.

## Jackson Configuration

### 1. Fail on Unknown Properties
```java
@JsonIgnoreProperties(ignoreUnknown = false)
public class MyFilter {
    @JsonProperty
    private String function;

    // This will throw exception on unknown properties
}
```

### 2. Custom Deserialization
```java
@JsonDeserialize(using = CustomDeserializer.class)
public class MyFilter {
    // Custom logic during deserialization
}
```

### 3. @JsonAnySetter for Validation
```java
public class MyFilter {
    @JsonProperty
    private String function;

    @JsonAnySetter
    public void handleUnknown(String key, Object value) {
        if (key == null || key.isEmpty()) {
            throw new IllegalArgumentException("Empty property keys not allowed");
        }
        // Validate other unknown properties
    }
}
```

## Validation Strategies

### Strategy 1: Whitelist Allowed Keys
```java
private static final Set<String> ALLOWED_KEYS =
    Set.of("function", "type", "name");

@JsonAnySetter
public void handleProperty(String key, Object value) {
    if (!ALLOWED_KEYS.contains(key)) {
        throw new IllegalArgumentException(
            "Unknown property: " + key);
    }
}
```

### Strategy 2: Reject Empty/Null Keys
```java
@JsonAnySetter
public void validateKey(String key, Object value) {
    if (key == null || key.trim().isEmpty()) {
        throw new IllegalArgumentException(
            "Property keys cannot be empty or null");
    }
}
```

### Strategy 3: Post-Deserialization Validation
```java
@JsonProperty
private Map<String, Object> properties;

@PostConstruct
public void validate() {
    for (String key : properties.keySet()) {
        if (key == null || key.isEmpty()) {
            throw new IllegalArgumentException(
                "Empty keys not allowed");
        }
    }
}
```

## Implementation in Druid

### Finding Vulnerable Classes
1. Search for `@JsonTypeName("javascript")`
2. Look for JavaScript filter/transform specs
3. Check deserialization of filter objects

### Key Locations
- `JavaScriptFilter.java` - Main JavaScript filter class
- Filter spec handlers in indexing-service
- Transform spec deserialization

### Fix Pattern
```java
@JsonIgnoreProperties(ignoreUnknown = false)
public class JavaScriptFilter {
    @JsonProperty
    private String function;

    @JsonAnySetter
    public void handleUnknown(String key, Object value) {

From cxcscmu/SkillLearnBench, MIT.

More from cxcscmu/SkillLearnBench