From 131e8576dcf3613f944c3e02527959bbf52370c3 Mon Sep 17 00:00:00 2001
From: Valera V Harseko <vharseko@3a-systems.ru>
Date: Fri, 17 Jul 2026 11:17:33 +0000
Subject: [PATCH] GHSA-68r5-9hpg-7qw9 Unauthenticated SSRF, local file read and unbounded-read DoS in the DSMLv2 gateway

---
 opendj-dsml-servlet/src/main/java/org/opends/dsml/protocol/DSMLServlet.java |   36 +++++++++++++++++++++++++++++++++++-
 1 files changed, 35 insertions(+), 1 deletions(-)

diff --git a/opendj-dsml-servlet/src/main/java/org/opends/dsml/protocol/DSMLServlet.java b/opendj-dsml-servlet/src/main/java/org/opends/dsml/protocol/DSMLServlet.java
index b93de93..3b2d725 100644
--- a/opendj-dsml-servlet/src/main/java/org/opends/dsml/protocol/DSMLServlet.java
+++ b/opendj-dsml-servlet/src/main/java/org/opends/dsml/protocol/DSMLServlet.java
@@ -13,6 +13,7 @@
  *
  * Copyright 2006-2010 Sun Microsystems, Inc.
  * Portions Copyright 2011-2016 ForgeRock AS.
+ * Portions Copyright 2026 3A Systems, LLC.
  */
 package org.opends.dsml.protocol;
 
@@ -119,6 +120,9 @@
   private static final String TRUSTALLCERTS = "ldap.trustall";
   private static final String USEHTTPAUTHZID = "ldap.authzidtypeisid";
   private static final String EXOPSTRINGPREFIX = "ldap.exop.string.";
+  private static final String DEREF_ANYURI = "ldap.dsml.dereference.anyuri";
+  private static final String DEREF_ANYURI_SCHEMES = "ldap.dsml.dereference.anyuri.schemes";
+  private static final String DEREF_ANYURI_MAXSIZE = "ldap.dsml.dereference.anyuri.maxsize";
   private static final long serialVersionUID = -3748022009593442973L;
   private static final AtomicInteger nextMessageID = new AtomicInteger(1);
 
@@ -190,9 +194,39 @@
         }
       }
 
-      // allow the use of anyURI values in adds and modifies
+      // Materialise anyURI values as java.net.URI so that, when dereferencing
+      // is explicitly enabled, they can be fetched. Dereferencing itself is
+      // gated and hardened in ByteStringUtility (disabled by default).
       System.setProperty("mapAnyUriToUri", "true");
 
+      // Server-side dereferencing of anyURI values is disabled by default
+      // (SSRF / local-file / unbounded-read hardening, GHSA-68r5-9hpg-7qw9).
+      // Enable it explicitly, and optionally tune the scheme allowlist and the
+      // maximum fetched size, via the corresponding context-params.
+      boolean derefAnyUri = booleanValue(config, DEREF_ANYURI);
+      ByteStringUtility.setDereferenceUri(derefAnyUri);
+      if (derefAnyUri)
+      {
+        String schemes = stringValue(config, DEREF_ANYURI_SCHEMES);
+        if (schemes != null && !schemes.trim().isEmpty())
+        {
+          ByteStringUtility.setAllowedUriSchemes(schemes);
+        }
+        String maxSize = stringValue(config, DEREF_ANYURI_MAXSIZE);
+        if (maxSize != null && !maxSize.trim().isEmpty())
+        {
+          try
+          {
+            ByteStringUtility.setMaxUriContentLength(Long.parseLong(maxSize.trim()));
+          }
+          catch (IllegalArgumentException e)
+          {
+            throw new ServletException(DEREF_ANYURI_MAXSIZE
+                + " must be a positive number of bytes, but was: " + maxSize);
+          }
+        }
+      }
+
       if(jaxbContext==null)
       {
         jaxbContext = JAXBContext.newInstance(PKG_NAME, getClass().getClassLoader());

--
Gitblit v1.10.0