CVE-2022-31139: Incorrect Authorization (CWE-863)
value: UnsafeAccessor (UA) is a bridge to access jdk.internal.misc.Unsafe & sun.misc.Unsafe. Normally, if UA is loaded as a named module, the internal data of UA is protected by JVM and others can only access UA via UA's standard API. The main application can set up `SecurityCheck.AccessLimiter` for UA to limit access to UA. Starting with version 1.4.0 and prior to version 1.7.0, when `SecurityCheck.AccessLimiter` is set up, untrusted code can access UA without limitation, even when UA is loaded as a named module. This issue does not affect those for whom `SecurityCheck.AccessLimiter` is not set up. Version 1.7.0 contains a patch.
CWE description: The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check. This allows attackers to bypass intended access restrictions.
CVSS v3 base score: 7.5
Published: 2022-07-11T19:15Z
Repository: https://github.com/Karlatemp/UnsafeAccessor
Language: Java
Files changed: api/src/main/java/io/github/karlatemp/unsafeaccessor/Root.java, api/src/main/java/io/github/karlatemp/unsafeaccessor/UnsafeAccess.java
Commit date: 2022-07-09 17:13:30 +0800
Commit message: Fix UnsafeAccess perm checking

Diff: diff --git a/api/src/main/java/io/github/karlatemp/unsafeaccessor/Root.java b/api/src/main/java/io/github/karlatemp/unsafeaccessor/Root.java
index 033cc32..cec3e06 100644
--- a/api/src/main/java/io/github/karlatemp/unsafeaccessor/Root.java
+++ b/api/src/main/java/io/github/karlatemp/unsafeaccessor/Root.java
@@ -155,12 +155,12 @@ public class Root {
      * @since 1.2.0
      */
     @Contract(pure = false)
     public static <T> T throw0(Throwable throwable) {
         if (throwable == null) throw new NullPointerException();
-        getUnsafe().throwException(throwable);
-        throw new RuntimeException();
+        Unsafe.getUnsafe0().throwException(throwable);
+        throw new RuntimeException(throwable);
     }
 
     /**
      * Allocate a new object, but not initialized.
      *
diff --git a/api/src/main/java/io/github/karlatemp/unsafeaccessor/UnsafeAccess.java b/api/src/main/java/io/github/karlatemp/unsafeaccessor/UnsafeAccess.java
index 7685b68..e63c7c9 100644
--- a/api/src/main/java/io/github/karlatemp/unsafeaccessor/UnsafeAccess.java
+++ b/api/src/main/java/io/github/karlatemp/unsafeaccessor/UnsafeAccess.java
@@ -15,11 +15,12 @@ import java.lang.reflect.AccessibleObject;
  */
 public final class UnsafeAccess extends ProtectedObject {
     static final UnsafeAccess INSTANCE = new UnsafeAccess();
 
     public static UnsafeAccess getInstance() {
-        SecurityCheck.getInstance();
+        SecurityCheck.AccessLimiter accessLimiter = SecurityCheck.getInstance().getLimiter();
+        if (accessLimiter != null) accessLimiter.preGetUnsafeAccess();
         return INSTANCE;
     }
 
     public SecurityCheck getSecuritySettings() {
         checkTrusted();

Vulnerable code:         getUnsafe().throwException(throwable);
        throw new RuntimeException();
        SecurityCheck.getInstance();
Fixed code:         Unsafe.getUnsafe0().throwException(throwable);
        throw new RuntimeException(throwable);
        SecurityCheck.AccessLimiter accessLimiter = SecurityCheck.getInstance().getLimiter();
        if (accessLimiter != null) accessLimiter.preGetUnsafeAccess();