groovy/groovy-core — pull request #416 by RichardHightower (2014-05-14 05:34:26+00:00)
Title: DDoS hash collision attack as reported by Jesse Wilson

Jesse brings out a good point, and his point might be more applicable
to Groovy. In fact, once I stopped arguing with him I realized that
Groovy was impacted a lot more than Boon, and Groovy is widely used and
Boon is not.

Also I think this impacted the old Groovy JSON parser as well but I
could be wrong.

The issue is described here:
http://publicobject.com/2014/05/11/the-json-benchmarks-are-wrong/

Boon might is less vulnerable than Groovy, but I patched it
today as well as a proof of concept for this.

http://rick-hightower.blogspot.com/2014/05/fud-gson-100x-faster-than-jackson-and.html

This does is not an issue for Boon and Pojos, but it is for Groovy and Pojos.

Boon Pojo support uses the API that knows about the index overlay for
Pojos so that is why this was not an issue with Boon (it avoids using a hashmap).

It seems Groovy is more vulnerable because it supports JDK 1.6 (Boon
does not) and the Map to Groovy object routines would not know about
the index overlay API, and would not know to avoid the map (which Boon does
for performance).

You can see an example here on how to access the underlying index
overlay method.

http://rick-hightower.blogspot.com/2014/05/fud-gson-100x-faster-than-jackson-and.html

Like Boon, Groovy is impacted in pretty much every public API that uses a map
(rare).

Unlike Boon (which is why this is more important for Groovy) this also impacts POJO
so 100% of public APIs unless you filter at payload
size with an F5 or scan the JSON stream ahead of time. The same index
overlay API exists (shown in blog) so there is a workaround, but since
with Groovy it is with both Map and Pojo, I took time off from everything else to
fix this.

This is a quick interim patch. It just works.

With this patch it should not be possible to ever do a hash key
collision attack. This patch checks for Java 1.7 and above and then
checks to see jdk.map.althashing.threshold is set if 1.7.

See http://docs.oracle.com/javase/7/docs/technotes/guides/collections/changes7.html

If Java is below 1.7, then it uses TreeMap, if Java is 1.7 and threshold not set
then this patch uses TreeMap. If Java 1.8, this patch uses
LinkedHashMap.