60 lines
2.2 KiB
Diff
60 lines
2.2 KiB
Diff
From 304f6fcb4e9124b9dbabf3ae28a3a7d21942429f Mon Sep 17 00:00:00 2001
|
|
From: Mikolaj Izdebski <mizdebsk@redhat.com>
|
|
Date: Mon, 7 Nov 2022 10:06:16 +0100
|
|
Subject: [PATCH] Fix CVE-2022-41853
|
|
|
|
Backport upstream fix for CVE-2022-41853 from SVN r6614.
|
|
Java methods used in routines must now be in hsqldb.method_class_names
|
|
value string.
|
|
|
|
Origin: https://git.centos.org/rpms/hsqldb/c/145c0b1fd04d9f3a3867d4ed210a5863fac28f57
|
|
|
|
https://sourceforge.net/p/hsqldb/svn/6614
|
|
---
|
|
src/org/hsqldb/persist/HsqlDatabaseProperties.java | 9 ++-------
|
|
1 file changed, 2 insertions(+), 7 deletions(-)
|
|
|
|
diff --git a/src/org/hsqldb/persist/HsqlDatabaseProperties.java b/src/org/hsqldb/persist/HsqlDatabaseProperties.java
|
|
index 2033183..b2012c2 100644
|
|
--- a/src/org/hsqldb/persist/HsqlDatabaseProperties.java
|
|
+++ b/src/org/hsqldb/persist/HsqlDatabaseProperties.java
|
|
@@ -57,14 +57,13 @@ public class HsqlDatabaseProperties extends HsqlProperties {
|
|
|
|
private static String hsqldb_method_class_names =
|
|
"hsqldb.method_class_names";
|
|
- private static HashSet accessibleJavaMethodNames;
|
|
+ private static HashSet accessibleJavaMethodNames = new HashSet();
|
|
|
|
static {
|
|
try {
|
|
String prop = System.getProperty(hsqldb_method_class_names);
|
|
|
|
if (prop != null) {
|
|
- accessibleJavaMethodNames = new HashSet();
|
|
|
|
String[] names = StringUtil.split(prop, ";");
|
|
|
|
@@ -77,7 +76,7 @@ public class HsqlDatabaseProperties extends HsqlProperties {
|
|
|
|
/**
|
|
* If the system property "hsqldb.method_class_names" is not set, then
|
|
- * static methods of all available Java classes can be accessed as functions
|
|
+ * static methods of available Java classes cannot be accessed as functions
|
|
* in HSQLDB. If the property is set, then only the list of semicolon
|
|
* seperated method names becomes accessible. An empty property value means
|
|
* no class is accessible.<p>
|
|
@@ -93,10 +92,6 @@ public class HsqlDatabaseProperties extends HsqlProperties {
|
|
*/
|
|
public static boolean supportsJavaMethod(String name) {
|
|
|
|
- if (accessibleJavaMethodNames == null) {
|
|
- return true;
|
|
- }
|
|
-
|
|
if (name.startsWith("org.hsqldb.Library.")) {
|
|
return true;
|
|
}
|
|
--
|
|
2.37.3
|
|
|