natas_hw
/
cassandra
mirror of https://github.com/apache/cassandra
0
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Update RMI object marshalling restrictions 

Patch by brandonwilliams; reviewed by paulo for CASSANDRA-20076
This commit is contained in:
Brandon Williams 2024-11-13 12:44:20 -06:00
parent 2f376f371e
commit 88a5ea76cf
1 changed files with 9 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

11
src/java/org/apache/cassandra/utils/JMXServerUtils.java
View File

@ -104,6 +104,8 @@ public class JMXServerUtils
// via a JAAS configuration entry, or one which delegates to the standard file based authenticator.
// Authn is disabled if com.sun.management.jmxremote.authenticate=false
env.putAll(configureJmxAuthentication());
// Secure credential passing to avoid deserialization attacks
env.putAll(configureSecureCredentials());
// Configure authz - if a custom proxy class is specified an instance will be returned.
// If not, but a location for the standard access file is set in system properties, the
@ -154,6 +156,13 @@ public class JMXServerUtils
return createJMXServer(port, null, local);
}
private static Map<String, Object> configureSecureCredentials()
{
Map<String, Object> env = new HashMap<>();
env.put("jmx.remote.rmi.server.credentials.filter.pattern", String.class.getName() + ";!*");
return env;
}
private static Map<String, Object> configureJmxAuthentication()
{
Map<String, Object> env = new HashMap<>();
@ -187,8 +196,6 @@ public class JMXServerUtils
env.put(JMXConnectorServer.AUTHENTICATOR, new JMXPluggableAuthenticatorWrapper(env));
}
env.put("jmx.remote.rmi.server.credential.types",
new String[] { String[].class.getName(), String.class.getName() });
return env;
}