Skip to content

validate permutation strong name before building symbol map paths#10328

Open
metsw24-max wants to merge 1 commit into
gwtproject:mainfrom
metsw24-max:deobfuscator-validate-strong-name
Open

validate permutation strong name before building symbol map paths#10328
metsw24-max wants to merge 1 commit into
gwtproject:mainfrom
metsw24-max:deobfuscator-validate-strong-name

Conversation

@metsw24-max

Copy link
Copy Markdown

The permutation strong name comes straight from the client X-GWT-Permutation header and is concatenated into the symbol/source map file name that openInputStream resolves:

resymbolize(trace, "../../../../etc/passwd")
-> openInputStream("../../../../etc/passwd.symbolMap")

ServerSerializationStreamReader already restricts the strong name to [a-zA-Z0-9_]+ before loading the policy file; this applies the same check inside the symbol/source map loaders so an out-of-range name is treated as not found.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant