[TASK] Use secure deserialization in extension manager 77/57477/2
authorOliver Hader <oliver@typo3.org>
Tue, 3 Jul 2018 14:16:19 +0000 (16:16 +0200)
committerTymoteusz Motylewski <t.motylewski@gmail.com>
Fri, 6 Jul 2018 07:24:45 +0000 (09:24 +0200)
In order to harden the deserialization of scalar and array values
in extension manager unserialize() calls are hardened further to
disallow object reconstitution. The information is retrieved from
the TYPO3 extension repository (TER) where according countermeasures
are in place to protect object injections - that's why this change
is considered as hardening and not as security issue.

Resolves: #85466
Releases: master, 8.7
Change-Id: I65b61d61e08d0c50b27ae9102d7ba4c4518a8788
Reviewed-on: https://review.typo3.org/57477
Tested-by: TYPO3com <no-reply@typo3.com>
Reviewed-by: Tymoteusz Motylewski <t.motylewski@gmail.com>
Tested-by: Tymoteusz Motylewski <t.motylewski@gmail.com>
typo3/sysext/extensionmanager/Classes/Utility/Connection/TerUtility.php
typo3/sysext/extensionmanager/Classes/Utility/EmConfUtility.php
typo3/sysext/extensionmanager/Classes/Utility/ExtensionModelUtility.php
typo3/sysext/extensionmanager/Classes/Utility/Parser/AbstractExtensionXmlParser.php

index d15d62f..de6c1b7 100644 (file)
@@ -102,7 +102,7 @@ class TerUtility
                     throw new ExtensionManagerException('Decoding Error: No decompressor available for compressed content. gzuncompress() function is not available!', 1342859463);
                 }
             }
-            $listArr = unserialize($dat);
+            $listArr = unserialize($dat, ['allowed_classes' => false]);
             if (!is_array($listArr)) {
                 throw new ExtensionManagerException('Error: Unserialized information was not an array - strange!', 1342859489);
             }
@@ -131,7 +131,7 @@ class TerUtility
             }
         }
         if (md5($parts[2]) === $parts[0]) {
-            $output = unserialize($parts[2]);
+            $output = unserialize($parts[2], ['allowed_classes' => false]);
             if (!is_array($output)) {
                 throw new ExtensionManagerException('Error: Content could not be unserialized to an array. Strange (since MD5 hashes match!)', 1344761938);
             }
index 2d12496..47657bf 100644 (file)
@@ -51,7 +51,7 @@ class EmConfUtility implements \TYPO3\CMS\Core\SingletonInterface
     public function constructEmConf(array $extensionData, \TYPO3\CMS\Extensionmanager\Domain\Model\Extension $extension = null)
     {
         if (is_object($extension) && empty($extensionData['EM_CONF']['constraints'])) {
-            $extensionData['EM_CONF']['constraints'] = unserialize($extension->getSerializedDependencies());
+            $extensionData['EM_CONF']['constraints'] = unserialize($extension->getSerializedDependencies(), ['allowed_classes' => false]);
         }
         $emConf = $this->fixEmConf($extensionData['EM_CONF']);
         $emConf = var_export($emConf, true);
index 5977ea5..4f6946e 100644 (file)
@@ -61,7 +61,7 @@ class ExtensionModelUtility
     public function convertDependenciesToObjects($dependencies)
     {
         $dependenciesObject = new \SplObjectStorage();
-        $unserializedDependencies = unserialize($dependencies);
+        $unserializedDependencies = unserialize($dependencies, ['allowed_classes' => false]);
         if (!is_array($unserializedDependencies)) {
             return $dependenciesObject;
         }
index b07ed85..aef2858 100644 (file)
@@ -403,7 +403,7 @@ abstract class AbstractExtensionXmlParser extends AbstractXmlParser
     protected function convertDependencies($dependencies)
     {
         $newDependencies = [];
-        $dependenciesArray = unserialize($dependencies);
+        $dependenciesArray = unserialize($dependencies, ['allowed_classes' => false]);
         if (is_array($dependenciesArray)) {
             foreach ($dependenciesArray as $version) {
                 if (!empty($version['kind']) && !empty($version['extensionKey'])) {