VSadov/Satori
1
0
Fork 0
mirror of https://github.com/VSadov/Satori.git synced 2025-06-11 18:20:26 +09:00
Code Activity

CVE-2023-24936: Check type is allowed when deserializing instance types that implements INullable (#87702)

Browse source 
Co-authored-by: Arthur Vickers <ajcvickers@hotmail.com>
This commit is contained in:
Shay Rojansky 2023-06-19 09:11:34 +02:00 • committed by GitHub
parent 815953a12c
commit 825f7c3f65
Signed by: github
GPG key ID: 4AEE18F83AFDEB23
2 changed files with 70 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

3
src/libraries/System.Data.Common/src/System/Data/Common/SqlUDTStorage.cs
View file

@ -182,6 +182,9 @@ namespace System.Data.Common
}
}
Type type = (typeName == null) ? _dataType : Type.GetType(typeName)!;
TypeLimiter.EnsureTypeIsAllowed(type);
object Obj = System.Activator.CreateInstance(type, true)!;
Debug.Assert(xmlReader is DataTextReader, "Invalid DataTextReader is being passed to customer");
((IXmlSerializable)Obj).ReadXml(xmlReader);

67
src/libraries/System.Data.Common/tests/System/Data/RestrictedTypeHandlingTests.cs
View file

@ -242,6 +242,59 @@ namespace System.Data.Tests
}
}
[Fact]
public void DataTable_HonorsGloballyDefinedAllowListForSqlTypes()
{
// Arrange
DataTable table = new DataTable("MyTable");
table.Columns.Add("MyNullableColumn", typeof(MyCustomNullable1));
table.Rows.Add(new MyCustomNullable1());
table.AcceptChanges();
var asXml = @$"<NewDataSet>
<xs:schema id=""NewDataSet"" xmlns="""" xmlns:xs=""http://www.w3.org/2001/XMLSchema"" xmlns:msdata=""urn:schemas-microsoft-com:xml-msdata"">
<xs:element name=""NewDataSet"" msdata:IsDataSet=""true"" msdata:MainDataTable=""MyTable"" msdata:UseCurrentLocale=""true"">
<xs:complexType>
<xs:choice minOccurs=""0"" maxOccurs=""unbounded"">
<xs:element name=""MyTable"">
<xs:complexType>
<xs:sequence>
<xs:element name=""MyNullableColumn"" msdata:DataType=""{typeof(MyCustomNullable1).AssemblyQualifiedName}"" type=""xs:anyType"" minOccurs=""0"" />
</xs:sequence>
</xs:complexType>
</xs:element>
</xs:choice>
</xs:complexType>
</xs:element>
</xs:schema>
<MyTable>
<MyNullableColumn xmlns:xsi=""http://www.w3.org/2001/XMLSchema-instance"" xmlns:xsd=""http://www.w3.org/2001/XMLSchema"" xmlns:msdata=""urn:schemas-microsoft-com:xml-msdata"" msdata:InstanceType=""{typeof(MyCustomNullable2).AssemblyQualifiedName}"">
<IsNull>false</IsNull>
</MyNullableColumn>
</MyTable>
</NewDataSet>";
// Act & assert
// Deserialization should fail since MyCustomNullable2 is not on the allow list,
// even though MyCustomNullable1 is on the allow list.
try
{
AppDomain.CurrentDomain.SetData(AppDomainDataSetDefaultAllowedTypesKey, new Type[]
{
typeof(MyCustomNullable1)
});
table = new DataTable();
Assert.Throws<InvalidOperationException>(() => table.ReadXml(new StringReader(asXml)));
}
finally
{
AppDomain.CurrentDomain.SetData(AppDomainDataSetDefaultAllowedTypesKey, null);
}
}
[Fact]
public void DataColumn_ConvertExpression_SubjectToAllowList_Success()
{
@ -401,6 +454,20 @@ namespace System.Data.Tests
{
}
public sealed class MyCustomNullable1 : INullable
{
public static MyCustomNullable1 Null { get; } = new MyCustomNullable1();
public bool IsNull => false;
}
public sealed class MyCustomNullable2 : INullable
{
public static MyCustomNullable2 Null { get; } = new MyCustomNullable2();
public bool IsNull => false;
}
public sealed class MyXmlSerializableClass : IXmlSerializable
{
public XmlSchema GetSchema()