Resolve CVE-2026-49432, etc (5.15.x)#247
Open
epearson-tt wants to merge 17 commits into
Open
Conversation
This commit fixes conversion of messages that are sent or received using Stomp when the body contains characters that require 4 bytes for encoding using standard UTF-8. ActiveMQ and OpenWire currently use a modified UTF-8 encoding that only uses 3 bytes so the conversion previously was breaking because the body was encoded using standard JDK UTF-8 encoding and set directly on an ActiveMQText message which was leading to decoding errors later when the ActiveMQMessage tried to decode using the modified encoder. The reverse was also was true and was breaking in some cases. The fix now makes sure to correctly decode the Stomp message back to a String first and set that on the ActiveMQ message so it can be re-encoded correctly. The reverse is fixed as well so both conversion from Stomp -> OpenWire and OpenWire -> Stomp work. Tests have been added for Stomp -> OpenWire, OpenWire -> Stomp, and Stomp -> Stomp which is really Stomp -> OpenWire -> Stomp. (cherry picked from commit 3ddf515) (cherry picked from commit 73a8d5c) (cherry picked from commit ea28f5a)
…che#2064) (apache#2066) This update makes the following changes to improve validation for the Stomp transport: * Verifies that the first frame seen by the server is either a CONNECT (or FRAME) frame. * Verifies that a duplicate CONNECT (or FRAME) frame is not received. * Adds validation to make sure a content-length header that is set is not negative. * Adds a new server mode (default true) to the Stomp wireformat to handle the validation differences between clients and servers. Client mode is only used for testing (currently). Also adds the option to configure using the StompWireFormatFactory in case there is a future use case. * Centralizes the state tracking for frame size validation and for the new validation checks inside StompWireFormat so that it is shared by NIO, non-NIO and WS transports. * Adds tests to verify everything for the NIO transports, non-NIO transprots and WS transports. If any of these new validation checks throw a protocol error then it is marked as a fatal exception, an error is sent to the client and connection closed. Both NIO and non-NIO will stop parsing the rest of the frame on error, but only NIO transport errors will stop reading the frame from the socket buffer because non NIO requires reading the entire frame into a buffer first to validate. (cherry picked from commit 1493db9) (cherry picked from commit 63ca733)
…he#2082) The max number of properties in the map for the WireFormatInfo command was lowered to 64 and a new max value buffer size was added to validate buffers created during unmarshalling of the properties map. The max buffer allowed has been set to 512 bytes. This also adds a maxDepth check for handling nested collections inside the map. It is set to 0 which will block list/map from being used as a value for a property. (cherry picked from commit 6fc46e5) (cherry picked from commit 42e2be7)
…ache#2083) (apache#2087) There should only ever be at most one BrokerInfo command received on a connection so we should throw an exception and close the connection if a second is receveived as that is a protocol error. (cherry picked from commit 80562ea) (cherry picked from commit 685ab0b)
…2074) (apache#2091) Change the admin security constraint mapping from *.action to /admin/* so the entire web console (including read-only pages) requires the admins role, not just action endpoints. Add comments to each constraint mapping explaining its scope, and remove duplicate Referrer-Policy and Permissions-Policy rewrite rules left over from earlier edits. (cherry picked from commit 085efea) Co-authored-by: JB Onofré <jbonofre@apache.org> (cherry picked from commit 1eda6a1)
…e#2077) (apache#2099) Validate the URIs provided by LDAP searches do not contain any protocols from the denied list. (cherry picked from commit ac3d064) (cherry picked from commit 0927bcb)
Fix typo introduced in apache#2089 (cherry picked from commit 83ce2ba) (cherry picked from commit 7e6705f)
…#2104) (apache#2108) Updates Stomp codec to check headers against max frame size during reading of the headers and not after when reading the body. (cherry picked from commit 7cb413b) (cherry picked from commit a7c1ab5)
…che#2107) (apache#2109) Optimizes the StompNIOSSLTransport by removing the unnecessary extra byte array allocation and buffer copy when processing frames (cherry picked from commit ac2f60a)
…pache#2115) For some reason ActiveMQConnection was using a map instead of a set to store the destinations, and just stored the exact same thing as the key and value. Furthermore, when checking if the map contained the destination a call was being made to containsValue() which requires iterating over the entire map. This commit replaced the Map with a Set which simplifies things and makes the contains() check constant. Also, the scope of the set was changed from public to package because it makes no sense to have the scope as public and should be limited to only classes in the same package. (cherry picked from commit b20a4c7) (cherry picked from commit 4e541f6)
…its read amounts (apache#2118) (apache#2121) This commit supplies a utility type that acts as a filter input stream style stream wrapper than can be configured with an available bytes window which decreases as bytes are read from the stream. This allows a transport or other utility to limit what can be read based on a fixed amount such as a max frame size option. (cherry picked from commit 81ab887) Co-authored-by: Timothy Bish <tabish121@gmail.com> (cherry picked from commit e6fac68)
…ng (apache#2122) (apache#2126) This adds a flag to allow other connections to create subscriptions on a temp destination, the default has been set to off. Setting to true enables some use cases to work such as failover but most of the time it is not needed and should be disabled to be JMS client spec compatible. The java client also already checked this, this now adds a broker side check as well. (cherry picked from commit d8c5672) (cherry picked from commit 708c90f)
…pache#2136) (apache#2145) This commit improves the brokers handling of messages that are corrupt and can't be read, such as unmarshaling the properties or body. Currently if there is an error an IOException is triggered and can lead to a client connection be closed. Furthermore for queues messages can be stuck and no new messages can be delivered. To improve things the following changes have been made: * The MarshallingSupport utility that is used to unmarshal message properties and bodies has improve validation to check for errors such is incorrectly encoded size values. * The broker will now handle message format errors both when messages are evaluated to add to subscriptions and during dispatch to consumers when the messages are already on a subscription. * The Stomp protocol converter was fixed to not auto ack or track acks until the message has been converted. * AMQP no longer swallows message format errors and will throw so the erors can be handled by the TransportConnection. All of these changes allow the broker to deal with corrupt messages and remove them (and possibly DLQ) vs causing the connections to close or the messages to block consumers forever in the queue case. (cherry picked from commit b20e61c) (cherry picked from commit 78bb8dc)
…ache#2146) (apache#2151) Fixes TwoSecureBrokerRequestReplyTest that was broken by apache#2122 . The test requires allowTempDestinationStealing to be enabled to work. (cherry picked from commit d4c0b3c) (cherry picked from commit f01a875)
…ze limited filter (apache#2154) (apache#2156) This update makes the following changes/improvements: * If the wrapped stream is finished and returns -1 this is now returned correctly and availableBytes are not decremented. * Partial reads now will be attempted up to the availableBytes limit * If 0 is passed in for the length for a partial read then no attempt to read is done and 0 is returned, in line with the spec. (cherry picked from commit 5d9c303) (cherry picked from commit 38ac99f)
5.15.x targets Java 8 (JDK-9+ APIs unavailable: List.of/Set.of/Map.of, String.repeat, no-arg Optional.orElseThrow) and JMS 1.1 (no MessageFormatRuntimeException; Connection/Session not AutoCloseable). Also adapts apache#2136 poison-ack handling to 5.15's MessageAck.POSION_ACK_TYPE (pre-rename typo) and TransportConnector (no isDisplayStackTrace), and aligns the relocated transport-validation JMX tests (apache#2077) to the new 'Transport scheme <x> is not allowed' message.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Addresses CVEs: