CVE-2018-6331 (Java, published 2018-12-31T23:29Z)
Description: value: Buck parser-cache command loads/saves state using Java serialized object. If the state information is maliciously crafted, deserializing it could lead to code execution. This issue affects Buck versions prior to v2018.06.25.01.
Severity: HIGH (CVSS v3 base score: 9.8)
Weakness: CWE-502 \u2014 Deserialization of Untrusted Data
The product deserializes untrusted data without sufficiently verifying that the resulting data will be valid.
Repository: https://github.com/facebook/buck
Files changed:
src/com/facebook/buck/cli/ParserCacheCommand.java
src/com/facebook/buck/parser/BUCK
src/com/facebook/buck/parser/ParserStateObjectInputStream.java
test/com/facebook/buck/cli/ParserCacheCommandIntegrationTest.java
Commit message: Prevent deserialization of random objects

Summary:
Fixed security issue with buck parser-cache command.
This diff prevent deserialization of random objects.

Reviewed By: jtorkkola

fbshipit-source-id: 24e8221


Vulnerable code:
        try (ObjectInputStream ois = new ObjectInputStream(zipis)) {

Fixed code:
import com.facebook.buck.parser.ParserStateObjectInputStream;
        try (ObjectInputStream ois = new ParserStateObjectInputStream(zipis)) {
        "ParserStateObjectInputStream.java",
/*
 * Copyright 2013-present Facebook, Inc.
 *
 * Licensed under the Apache License, Version 2.0 (the "License"); you may
 * not use this file except in compliance with the License. You may obtain
 * a copy of the License at
 *
 *     http://www.apache.org/licenses/LICENSE-2.0
 *
 * Unless required by applicable law or agreed to in writing, software
 * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
 * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
 * License for the specific language governing permissions and limitations
 * under the License.
 */

package com.facebook.buck.parser;

import com.facebook.buck.parser.thrift.RemoteDaemonicParserState;
import java.io.IOException;
import java.io.InputStream;
import java.io.InvalidClassException;
import java.io.ObjectInputStream;
import java.io.ObjectStreamClass;
import java.util.HashSet;
import java.util.Set;

/** A ObjectInputStream that will deserialize only RemoteDaemonicParserState. */
public class ParserStateObjectInputStream extends ObjectInputStream {

  private Set<String> whitelist;

  public ParserStateObjectInputStream(InputStream inputStream) throws IOException {
    super(inputStream);

    whitelist = new HashSet<>();
    whitelist.add(RemoteDaemonicParserState.class.getName());
  }

  @Override
  protected Class<?> resolveClass(ObjectStreamClass desc)
      throws IOException, ClassNotFoundException {
    if (!whitelist.contains(desc.getName())) {
      throw new InvalidClassException(desc.getName(), "Can't deserialize this class");
    }
    return super.resolveClass(desc);
  }
}
import java.io.FileOutputStream;
import java.io.InvalidClassException;
import java.io.ObjectOutputStream;
import java.util.HashMap;
import java.util.Map;
import java.util.zip.ZipEntry;
import java.util.zip.ZipOutputStream;
import org.junit.rules.ExpectedException;
  @Rule public ExpectedException thrown = ExpectedException.none();

  @Test
  public void testInvalidData() throws IOException {
    Map<String, String> invalidData = new HashMap();
    invalidData.put("foo", "bar");

    NamedTemporaryFile tempFile = new NamedTemporaryFile("invalid_parser_data", null);
    try (FileOutputStream fos = new FileOutputStream(tempFile.get().toString());
        ZipOutputStream zipos = new ZipOutputStream(fos)) {
      zipos.putNextEntry(new ZipEntry("parser_data"));
      try (ObjectOutputStream oos = new ObjectOutputStream(zipos)) {
        oos.writeObject(invalidData);
      }
    }

    ProjectWorkspace workspace =
        TestDataHelper.createProjectWorkspaceForScenario(this, "parser_with_cell", tmp);
    workspace.setUp();

    // Load the invalid parser cache data.
    thrown.expect(InvalidClassException.class);
    thrown.expectMessage("Can't deserialize this class");
    workspace.runBuckCommand("parser-cache", "--load", tempFile.get().toString());
  }