T09 · Insecure Skill Coding Practices
Error
- Location
scripts/generate_structure.py:252- Finding
Unsafe Jackson Polymorphic Deserialization in Redis Templates
- Content
View full analysis
redisTemplate(RedisConnectionFactory connectionFactory) { RedisTemplate template = new RedisTemplate<>(); template.setConnectionFactory(connectionFactory); Jackson2JsonRedisSerializer serializer = new Jackson2JsonRedisSerializer<>(Object.class); ObjectMapper mapper = new ObjectMapper(); mapper.activateDefaultTyping( LaissezFaireSubTypeValidator.instance, ObjectMapper.DefaultTyping.NON_FINAL, JsonTypeInfo.As.PROPERTY ); serializer.setObjectMapper(mapper); StringRedisSerializer stringSerializer = new StringRedisSerializer(); template.setKeySerializer(stringSerializer); template.setHashKeySerializer(stringSerializer); template.setValueSerializer(serializer); template.setHashValueSerializer(serializer); template.afterPropertiesSet(); return template; } ``` ### Technical Analysis The generated Redis configuration enables Jackson default typing for all non-final classes and uses `LaissezFaireSubTypeValidator`, which does not impose a meaningful restriction on polymorphic subtypes. Serialized values may consequently include type metadata instructing Jackson which application or dependency class to instantiate. When an application reads an attacker-controlled Redis value through this `RedisTemplate`, Jackson may instantiate a class selected by the attacker. If the generated application's classpath co ...[truncated 2071 chars]- Remediation
View remediation