Potential leak of application internals in ExportedObject.getAnnotations() about dbus-java HOT 5 CLOSED

Thanks for the report. I don't have much spare time atm, but I hope the fix I just commited will handle this issue

from dbus-java.

I have not tried it, but 01381b9 appears to break all annotations, as Annotation will never be an instance of DBusInterface. You would have to use annotation.annotationType().isAssignableFrom(DBusInterface.class), which also would never evaluate to true since that would never be the case.

If I may make a recommendation, create a @DBusAnnotation annotation that is used to annotate other annotations that should be considered by the method referred to in 01381b9, which would enumerate each annotation and check if annotation.annotationType().getAnnotation(DBusAnnotation.class) != null, in which case the former annotation would be included in the introspection output.

This creates an explicit API that pushes the security concerns onto the consumer of dbus-java, allowing them to make those security decisions.

Further, as far as I'm aware, annotations within introspection data that don't pertain to D-Bus proper aren't used by any of the standard tooling and thus are rather useless to anyone that doesn't explicitly consume them via the org.freedesktop.DBus.Introspectable interface (see Introspection Format from the spec, which as of this writing outlines only 4 annotations).

Therefore, this could potentially be moot and only the annotations that D-Bus cares about could be checked (i.e. calling iface.getAnnotation(DBusInterfaceName.class) directly). This would be slightly simpler code as well as much more restrictive and thus more secure.

Thank you for the response - the concern is appreciated.

Just a suggestion. Thank you for your response.

from dbus-java.

If you already have a proper fix, please provide a pull request and will merge it.

from dbus-java.

any news on this?
Did you review my changes?

from dbus-java.

as there is no feedback yet, I assume this issue is fixed.

from dbus-java.