Skip to content

Defend against attempts to bypass JVM serial proxy #522

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Open
wants to merge 11 commits into
base: master
Choose a base branch
from
Open

Defend against attempts to bypass JVM serial proxy #522

wants to merge 11 commits into from

Conversation

lukellmann
Copy link
Contributor

@lukellmann lukellmann commented Apr 26, 2025 •
edited
Loading

No description provided.

@lukellmann
Defend against attempts to bypass JVM serial proxy
4f03309 
Also add serialVersionUID for exception classes. This ensures that
unrelated changes in these exception classes don't affect the serialized
form.

The serialVersionUIDs are from 7380325.
After running ./gradlew publishToMavenLocal, they were obtained with the
serialver tool [1]:

$ serialver -classpath .m2/repository/org/jetbrains/kotlinx/kotlinx-datetime-jvm/0.6.2-SNAPSHOT/kotlinx-datetime-jvm-0.6.2-SNAPSHOT.jar:kotlin-stdlib-2.1.0.jar kotlinx.datetime.LocalDate kotlinx.datetime.LocalDateTime kotlinx.datetime.LocalTime kotlinx.datetime.UtcOffset kotlinx.datetime.DateTimeArithmeticException kotlinx.datetime.IllegalTimeZoneException kotlinx.datetime.DateTimeFormatException kotlinx.datetime.internal.format.parser.ParseException
kotlinx.datetime.LocalDate:    private static final long serialVersionUID = 7026816023079564263L;
kotlinx.datetime.LocalDateTime:    private static final long serialVersionUID = -4261744960416354711L;
kotlinx.datetime.LocalTime:    private static final long serialVersionUID = -352249606036216323L;
kotlinx.datetime.UtcOffset:    private static final long serialVersionUID = -6636773355667981618L;
kotlinx.datetime.DateTimeArithmeticException:    private static final long serialVersionUID = -3207806170214997982L;
kotlinx.datetime.IllegalTimeZoneException:    private static final long serialVersionUID = 1159315966274264801L;
kotlinx.datetime.DateTimeFormatException:    private static final long serialVersionUID = 4231196759387994100L;
kotlinx.datetime.internal.format.parser.ParseException:    private static final long serialVersionUID = 5691186997393344103L;

[1] https://docs.oracle.com/en/java/javase/21/docs/specs/man/serialver.html
@lukellmann lukellmann mentioned this pull request Apr 26, 2025
Closed
lukellmann
lukellmann commented Apr 26, 2025
View reviewed changes
@dkhalanskyjb dkhalanskyjb added this to the 0.7.0 milestone Apr 28, 2025
@dkhalanskyjb dkhalanskyjb requested a review from ilya-g April 28, 2025 13:36
ilya-g
ilya-g requested changes May 27, 2025
View reviewed changes
@lukellmann
Copy link
Contributor Author

For 89fd818 serialver now outputs this (LocalDate has a different serialVersionUID):

$ serialver -classpath .m2/repository/org/jetbrains/kotlinx/kotlinx-datetime-jvm/0.6.2-SNAPSHOT/kotlinx-datetime-jvm-0.6.2-SNAPSHOT.jar:kotlin-stdlib-2.1.20.jar kotlinx.datetime.LocalDate kotlinx.datetime.LocalDateTime kotlinx.datetime.LocalTime kotlinx.datetime.UtcOffset kotlinx.datetime.DateTimeArithmeticException kotlinx.datetime.IllegalTimeZoneException kotlinx.datetime.DateTimeFormatException kotlinx.datetime.internal.format.parser.ParseException
kotlinx.datetime.LocalDate:    private static final long serialVersionUID = -9141474295923275006L;
kotlinx.datetime.LocalDateTime:    private static final long serialVersionUID = -4261744960416354711L;
kotlinx.datetime.LocalTime:    private static final long serialVersionUID = -352249606036216323L;
kotlinx.datetime.UtcOffset:    private static final long serialVersionUID = -6636773355667981618L;
kotlinx.datetime.DateTimeArithmeticException:    private static final long serialVersionUID = -3207806170214997982L;
kotlinx.datetime.IllegalTimeZoneException:    private static final long serialVersionUID = 1159315966274264801L;
kotlinx.datetime.DateTimeFormatException:    private static final long serialVersionUID = 4231196759387994100L;
kotlinx.datetime.internal.format.parser.ParseException:    private static final long serialVersionUID = 5691186997393344103L;

I won't update it here though. The actual value doesn't matter, non-malicious serialization will not use it since it goes through kotlinx.datetime.Ser. It's just important that it stays stable for MaliciousJvmSerializationTest after this PR is merged, see #522 (comment).

@lukellmann
Copy link
Contributor Author

The actual value doesn't matter, non-malicious serialization will not use it since it goes through kotlinx.datetime.Ser. It's just important that it stays stable for MaliciousJvmSerializationTest after this PR is merged, see #522 (comment).

I've changed the serialVersionUID to 0L for the classes where the value doesn't matter.

@lukellmann
Copy link
Contributor Author

lukellmann commented Jun 3, 2025 •
edited
Loading

I've extracted the changes unrelated to bypassing the proxy into #533.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@ilya-g ilya-g ilya-g approved these changes

Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
0.7.0
Development

Successfully merging this pull request may close these issues.
3 participants
@lukellmann @ilya-g @dkhalanskyjb