Skip to content

Commit e77435a

Browse files
dualspiraldualspiral
committed
Add additional JNDI protections
1 parent ecd2fc2 commit e77435a

File tree

5 files changed

+179
-1
lines changed

5 files changed

+179
-1
lines changed

‎src/main/java/org/spongepowered/common/mixin/exploit/EntityDataManagerMixin_JNDIChatMessageBlock.java‎

Lines changed: 55 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,55 @@
1+
/*
2+
* This file is part of Sponge, licensed under the MIT License (MIT).
3+
*
4+
* Copyright (c) SpongePowered <https://www.spongepowered.org>
5+
* Copyright (c) contributors
6+
*
7+
* Permission is hereby granted, free of charge, to any person obtaining a copy
8+
* of this software and associated documentation files (the "Software"), to deal
9+
* in the Software without restriction, including without limitation the rights
10+
* to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
11+
* copies of the Software, and to permit persons to whom the Software is
12+
* furnished to do so, subject to the following conditions:
13+
*
14+
* The above copyright notice and this permission notice shall be included in
15+
* all copies or substantial portions of the Software.
16+
*
17+
* THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
18+
* IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
19+
* FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
20+
* AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
21+
* LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
22+
* OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
23+
* THE SOFTWARE.
24+
*/
25+
package org.spongepowered.common.mixin.exploit;
26+
27+
import net.minecraft.network.datasync.DataParameter;
28+
import net.minecraft.network.datasync.EntityDataManager;
29+
import org.spongepowered.asm.mixin.Mixin;
30+
import org.spongepowered.asm.mixin.injection.At;
31+
import org.spongepowered.asm.mixin.injection.Inject;
32+
import org.spongepowered.asm.mixin.injection.callback.CallbackInfo;
33+
import org.spongepowered.common.text.chat.ChatUtil;
34+
35+
@Mixin(EntityDataManager.class)
36+
public abstract class EntityDataManagerMixin_JNDIChatMessageBlock {
37+
38+
@Inject(method = "setEntry", at = @At("HEAD"), cancellable = true)
39+
private void exploit$blockJNDIEntryIntoDataManagerViaSetEntry(final DataParameter<?> key, final Object value, CallbackInfo ci) {
40+
this.exploit$blockAttemptedJDNIExploit(value, ci);
41+
}
42+
43+
@Inject(method = "set", at = @At("HEAD"), cancellable = true)
44+
private void exploit$blockJNDIEntryIntoDataManagerViaSet(final DataParameter<?> key, final Object value, CallbackInfo ci) {
45+
this.exploit$blockAttemptedJDNIExploit(value, ci);
46+
}
47+
48+
private void exploit$blockAttemptedJDNIExploit(final Object value, final CallbackInfo ci) {
49+
if (ChatUtil.isExploitable(value)) {
50+
// block the message because we know it could cause problems.
51+
// this just tells the client the message could not be sent.
52+
ci.cancel();
53+
}
54+
}
55+
}

‎src/main/java/org/spongepowered/common/mixin/exploit/EntityDataManager_DataEntryMixin_JNDIChatMessageBlock.java‎

Lines changed: 47 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,47 @@
1+
/*
2+
* This file is part of Sponge, licensed under the MIT License (MIT).
3+
*
4+
* Copyright (c) SpongePowered <https://www.spongepowered.org>
5+
* Copyright (c) contributors
6+
*
7+
* Permission is hereby granted, free of charge, to any person obtaining a copy
8+
* of this software and associated documentation files (the "Software"), to deal
9+
* in the Software without restriction, including without limitation the rights
10+
* to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
11+
* copies of the Software, and to permit persons to whom the Software is
12+
* furnished to do so, subject to the following conditions:
13+
*
14+
* The above copyright notice and this permission notice shall be included in
15+
* all copies or substantial portions of the Software.
16+
*
17+
* THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
18+
* IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
19+
* FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
20+
* AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
21+
* LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
22+
* OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
23+
* THE SOFTWARE.
24+
*/
25+
package org.spongepowered.common.mixin.exploit;
26+
27+
import net.minecraft.network.datasync.DataParameter;
28+
import net.minecraft.network.datasync.EntityDataManager;
29+
import org.spongepowered.asm.mixin.Mixin;
30+
import org.spongepowered.asm.mixin.injection.At;
31+
import org.spongepowered.asm.mixin.injection.Inject;
32+
import org.spongepowered.asm.mixin.injection.callback.CallbackInfo;
33+
import org.spongepowered.common.text.chat.ChatUtil;
34+
35+
@Mixin(EntityDataManager.DataEntry.class)
36+
public abstract class EntityDataManager_DataEntryMixin_JNDIChatMessageBlock {
37+
38+
39+
@Inject(method = "setValue", at = @At("HEAD"), cancellable = true)
40+
private void exploit$blockJNDIEntryIntoDataManagerViaSet(final Object valueIn, final CallbackInfo ci) {
41+
if (ChatUtil.isExploitable(valueIn)) {
42+
// block the message because we know it could cause problems.
43+
// this just tells the client the message could not be sent.
44+
ci.cancel();
45+
}
46+
}
47+
}

‎src/main/java/org/spongepowered/common/mixin/exploit/ItemStackMixin_JNDIChatMessageBlock.java‎

Lines changed: 61 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,61 @@
1+
/*
2+
* This file is part of Sponge, licensed under the MIT License (MIT).
3+
*
4+
* Copyright (c) SpongePowered <https://www.spongepowered.org>
5+
* Copyright (c) contributors
6+
*
7+
* Permission is hereby granted, free of charge, to any person obtaining a copy
8+
* of this software and associated documentation files (the "Software"), to deal
9+
* in the Software without restriction, including without limitation the rights
10+
* to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
11+
* copies of the Software, and to permit persons to whom the Software is
12+
* furnished to do so, subject to the following conditions:
13+
*
14+
* The above copyright notice and this permission notice shall be included in
15+
* all copies or substantial portions of the Software.
16+
*
17+
* THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
18+
* IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
19+
* FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
20+
* AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
21+
* LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
22+
* OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
23+
* THE SOFTWARE.
24+
*/
25+
package org.spongepowered.common.mixin.exploit;
26+
27+
import net.minecraft.item.ItemStack;
28+
import net.minecraft.nbt.NBTTagCompound;
29+
import org.spongepowered.asm.mixin.Mixin;
30+
import org.spongepowered.asm.mixin.injection.At;
31+
import org.spongepowered.asm.mixin.injection.Inject;
32+
import org.spongepowered.asm.mixin.injection.Redirect;
33+
import org.spongepowered.asm.mixin.injection.callback.CallbackInfoReturnable;
34+
import org.spongepowered.common.text.chat.ChatUtil;
35+
36+
@Mixin(ItemStack.class)
37+
public abstract class ItemStackMixin_JNDIChatMessageBlock {
38+
39+
@Redirect(method = "getDisplayName", at = @At(value = "INVOKE", target = "Lnet/minecraft/nbt/NBTTagCompound;hasKey(Ljava/lang/String;I)Z"))
40+
private boolean exploit$ignoreExploitableItemNames(final NBTTagCompound instance, final String key, final int type) {
41+
return instance.hasKey(key, type) && type == 8 && !ChatUtil.isExploitable(instance.getString(key));
42+
}
43+
44+
@Inject(method = "setStackDisplayName", at = @At("HEAD"), cancellable = true)
45+
private void exploit$ignoreExploitableItemNamesOnSetName(
46+
final String displayName, final CallbackInfoReturnable<ItemStack> cir) {
47+
if (ChatUtil.isExploitable(displayName)) {
48+
cir.setReturnValue((ItemStack) (Object) this);
49+
}
50+
}
51+
52+
@Inject(method = "setTranslatableName", at = @At("HEAD"), cancellable = true)
53+
private void exploit$ignoreExploitableItemNamesOnSetTranslatableName(
54+
final String translatableName, final CallbackInfoReturnable<ItemStack> cir) {
55+
// just in case
56+
if (ChatUtil.isExploitable(translatableName)) {
57+
cir.setReturnValue((ItemStack) (Object) this);
58+
}
59+
}
60+
61+
}

‎src/main/java/org/spongepowered/common/text/chat/ChatUtil.java‎

Lines changed: 13 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -24,7 +24,6 @@
2424
*/
2525
package org.spongepowered.common.text.chat;
2626

27-
import net.minecraft.network.play.server.SPacketChat;
2827
import net.minecraft.util.text.ITextComponent;
2928
import net.minecraft.util.text.TextComponentTranslation;
3029
import net.minecraft.util.text.TextFormatting;
@@ -52,6 +51,19 @@ private ChatUtil() {
5251

5352
public static final String JNDI_EXPLOIT_FRAGMENT = "${jndi";
5453

54+
public static boolean isExploitable(final Object message) {
55+
if (message instanceof String) {
56+
return ChatUtil.isExploitable((String) message);
57+
} else if (message instanceof ITextComponent) {
58+
return ChatUtil.isExploitable((ITextComponent) message);
59+
}
60+
return false;
61+
}
62+
63+
public static boolean isExploitable(final ITextComponent message) {
64+
return ChatUtil.isExploitable(message.getUnformattedText());
65+
}
66+
5567
public static boolean isExploitable(final String message) {
5668
return message.toLowerCase(Locale.ROOT).contains(ChatUtil.JNDI_EXPLOIT_FRAGMENT);
5769
}

‎src/main/resources/mixins.common.exploit.json‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -7,6 +7,9 @@
77
"compatibilityLevel": "JAVA_8",
88
"mixins": [
99
"AnvilChunkLoaderMixin_FilterInvalidEntities",
10+
"EntityDataManager_DataEntryMixin_JNDIChatMessageBlock",
11+
"EntityDataManagerMixin_JNDIChatMessageBlock",
12+
"ItemStackMixin_JNDIChatMessageBlock",
1013
"MinecraftServerMixin_JNDIChatMessageBlock",
1114
"NetHandlerPlayServerMixin_JNDIChatMessageBlock",
1215
"NetHandlerPlayServerMixin_SlotAndSizeFix",

0 commit comments

Comments
 (0)