From 131e8576dcf3613f944c3e02527959bbf52370c3 Mon Sep 17 00:00:00 2001
From: Valera V Harseko <vharseko@3a-systems.ru>
Date: Fri, 17 Jul 2026 11:17:33 +0000
Subject: [PATCH] GHSA-68r5-9hpg-7qw9 Unauthenticated SSRF, local file read and unbounded-read DoS in the DSMLv2 gateway
---
opendj-dsml-servlet/src/main/java/org/opends/dsml/protocol/DSMLServlet.java | 36 +++++++++++++++++++++++++++++++++++-
1 files changed, 35 insertions(+), 1 deletions(-)
diff --git a/opendj-dsml-servlet/src/main/java/org/opends/dsml/protocol/DSMLServlet.java b/opendj-dsml-servlet/src/main/java/org/opends/dsml/protocol/DSMLServlet.java
index b93de93..3b2d725 100644
--- a/opendj-dsml-servlet/src/main/java/org/opends/dsml/protocol/DSMLServlet.java
+++ b/opendj-dsml-servlet/src/main/java/org/opends/dsml/protocol/DSMLServlet.java
@@ -13,6 +13,7 @@
*
* Copyright 2006-2010 Sun Microsystems, Inc.
* Portions Copyright 2011-2016 ForgeRock AS.
+ * Portions Copyright 2026 3A Systems, LLC.
*/
package org.opends.dsml.protocol;
@@ -119,6 +120,9 @@
private static final String TRUSTALLCERTS = "ldap.trustall";
private static final String USEHTTPAUTHZID = "ldap.authzidtypeisid";
private static final String EXOPSTRINGPREFIX = "ldap.exop.string.";
+ private static final String DEREF_ANYURI = "ldap.dsml.dereference.anyuri";
+ private static final String DEREF_ANYURI_SCHEMES = "ldap.dsml.dereference.anyuri.schemes";
+ private static final String DEREF_ANYURI_MAXSIZE = "ldap.dsml.dereference.anyuri.maxsize";
private static final long serialVersionUID = -3748022009593442973L;
private static final AtomicInteger nextMessageID = new AtomicInteger(1);
@@ -190,9 +194,39 @@
}
}
- // allow the use of anyURI values in adds and modifies
+ // Materialise anyURI values as java.net.URI so that, when dereferencing
+ // is explicitly enabled, they can be fetched. Dereferencing itself is
+ // gated and hardened in ByteStringUtility (disabled by default).
System.setProperty("mapAnyUriToUri", "true");
+ // Server-side dereferencing of anyURI values is disabled by default
+ // (SSRF / local-file / unbounded-read hardening, GHSA-68r5-9hpg-7qw9).
+ // Enable it explicitly, and optionally tune the scheme allowlist and the
+ // maximum fetched size, via the corresponding context-params.
+ boolean derefAnyUri = booleanValue(config, DEREF_ANYURI);
+ ByteStringUtility.setDereferenceUri(derefAnyUri);
+ if (derefAnyUri)
+ {
+ String schemes = stringValue(config, DEREF_ANYURI_SCHEMES);
+ if (schemes != null && !schemes.trim().isEmpty())
+ {
+ ByteStringUtility.setAllowedUriSchemes(schemes);
+ }
+ String maxSize = stringValue(config, DEREF_ANYURI_MAXSIZE);
+ if (maxSize != null && !maxSize.trim().isEmpty())
+ {
+ try
+ {
+ ByteStringUtility.setMaxUriContentLength(Long.parseLong(maxSize.trim()));
+ }
+ catch (IllegalArgumentException e)
+ {
+ throw new ServletException(DEREF_ANYURI_MAXSIZE
+ + " must be a positive number of bytes, but was: " + maxSize);
+ }
+ }
+ }
+
if(jaxbContext==null)
{
jaxbContext = JAXBContext.newInstance(PKG_NAME, getClass().getClassLoader());
--
Gitblit v1.10.0