Find unsafe Java deserialization
Recipe ID
org.openrewrite.kotlin.security.FindUnsafeDeserialization$KtRecipeArtifact
io.moderne.recipe:recipes-kotlinJava native deserialization is the source of the Apache Commons gadget-chain RCE family. Each ObjectInputStream allocation needs an explicit ObjectInputFilter (Java 9+) or a replacement encoding.
Usage
This recipe has no required configuration options. You’ll need the Moderne CLI configured before running the command below.
mod run . --recipe org.openrewrite.kotlin.security.FindUnsafeDeserialization$KtRecipeIf the recipe isn’t available locally, install it with:
mod config recipes jar install io.moderne.recipe:recipes-kotlin:0.2.0Definition
This recipe runs the following recipes in order.
- Find
ObjectInputStream(...)constructionsorg.openrewrite.kotlin.security.FindObjectInputStream$KtRecipe
Data tables
Structured output this recipe can produce.
- Source files that had resultsSource files that were modified by the recipe run.
org.openrewrite.table.SourcesFileResults - Source files that had search resultsSearch results that were found during the recipe run.
org.openrewrite.table.SearchResults - Source files that errored on a recipeThe details of all errors produced by a recipe run.
org.openrewrite.table.SourcesFileErrors - Recipe performanceStatistics used in analyzing the performance of recipes.
org.openrewrite.table.RecipeRunStats