[GEODE-10599] Secure JMX query expression deserialization via ValidatingObjectInputStream (#8025)

* Secure JMX query expression deserialization via ValidatingObjectInputStream

* fix formatting

* license

Author: JinwooHwang

geode-web/src/main/java/org/apache/geode/management/internal/web/controllers/ShellCommandsController.java

@@ -17,6 +17,7 @@
 import static org.apache.commons.io.IOUtils.toInputStream;
 import static org.apache.geode.management.internal.web.util.UriUtils.decode;
 
+import java.io.ByteArrayInputStream;
 import java.io.FileInputStream;
 import java.io.IOException;
 import java.nio.file.Path;
@@ -34,6 +35,7 @@
 import javax.management.ReflectionException;
 
 import org.apache.commons.io.FileUtils;
+import org.apache.commons.io.serialization.ValidatingObjectInputStream;
 import org.apache.commons.lang3.ArrayUtils;
 import org.springframework.core.io.InputStreamResource;
 import org.springframework.http.HttpHeaders;
@@ -169,8 +171,12 @@ public ResponseEntity<?> queryNames(@RequestParam("objectName") final String obj
     ObjectName name = ObjectName.getInstance(decode(objectName));
     QueryExp query = null;
     if (queryExpressionBase64 != null) {
-      query =
-          (QueryExp) IOUtils.deserializeObject(Base64.getDecoder().decode(queryExpressionBase64));
+      byte[] decodedBytes = Base64.getDecoder().decode(queryExpressionBase64);
+      try (ValidatingObjectInputStream ois =
+          new ValidatingObjectInputStream(new ByteArrayInputStream(decodedBytes))) {
+        ois.accept("javax.management.*", "java.lang.*", "java.util.*");
+        query = (QueryExp) ois.readObject();
+      }
     }
     final Set<ObjectName> objectNames = getMBeanServer().queryNames(name, query);
     return new ResponseEntity<>(IOUtils.serializeObject(objectNames), HttpStatus.OK);

geode-web/src/test/java/org/apache/geode/management/internal/web/controllers/QueryExpDeserializationTest.java

@@ -0,0 +1,44 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one or more contributor license
+ * agreements. See the NOTICE file distributed with this work for additional information regarding
+ * copyright ownership. The ASF licenses this file to You under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance with the License. You may obtain a
+ * copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software distributed under the License
+ * is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express
+ * or implied. See the License for the specific language governing permissions and limitations under
+ * the License.
+ */
+package org.apache.geode.management.internal.web.controllers;
+
+import java.io.ByteArrayInputStream;
+import java.io.ByteArrayOutputStream;
+import java.io.ObjectOutputStream;
+
+import javax.management.Query;
+import javax.management.QueryExp;
+
+import org.apache.commons.io.serialization.ValidatingObjectInputStream;
+import org.junit.Test;
+
+public class QueryExpDeserializationTest {
+  @Test
+  public void testQueryExp() throws Exception {
+    QueryExp query = Query.eq(Query.attr("Name"), Query.value("mock"));
+    ByteArrayOutputStream baos = new ByteArrayOutputStream();
+    ObjectOutputStream oos = new ObjectOutputStream(baos);
+    oos.writeObject(query);
+    oos.close();
+
+    byte[] decoded = baos.toByteArray();
+    ValidatingObjectInputStream ois =
+        new ValidatingObjectInputStream(new ByteArrayInputStream(decoded));
+    ois.accept("javax.management.*", "java.lang.*", "java.util.*");
+
+    QueryExp q = (QueryExp) ois.readObject();
+    System.out.println(q);
+  }
+}