Skip to content

Commit

Permalink
CVE-2024-38827 (#351)
Browse files Browse the repository at this point in the history
  • Loading branch information
@kevin-mcgoldrick
kevin-mcgoldrick authored Jan 16, 2025
1 parent 6fd2f6a commit 8dad027
Show file tree
Hide file tree
Showing 3 changed files with 33 additions and 48 deletions.
10 changes: 5 additions & 5 deletions proxy-parent/owasp-proxy/pom.xml
View file
Original file line number Diff line number Diff line change
Expand Up @@ -32,14 +32,14 @@
<dependencies>
<dependency>
<groupId>org.bouncycastle</groupId>
<artifactId>bcprov-jdk15on</artifactId>
<version>1.47</version>
<artifactId>bcprov-jdk18on</artifactId>
<version>1.79</version>
</dependency>

<dependency>
<groupId>org.bouncycastle</groupId>
<artifactId>bcpkix-jdk15on</artifactId>
<version>1.47</version>
<artifactId>bcpkix-jdk18on</artifactId>
<version>1.79</version>
</dependency>
<dependency>
<groupId>org.apache.httpcomponents</groupId>
Expand All @@ -48,7 +48,7 @@
<dependency>
<groupId>org.springframework</groupId>
<artifactId>spring-jdbc</artifactId>
<version>2.5.6</version>
<version>6.2.0</version>
<scope>compile</scope>
<exclusions>
<exclusion>
Expand Down
63 changes: 26 additions & 37 deletions proxy-parent/owasp-proxy/src/main/java/org/owasp/proxy/http/dao/JdbcMessageDAO.java
View file
Original file line number Diff line number Diff line change
Expand Up @@ -42,10 +42,10 @@
import org.springframework.dao.DataAccessException;
import org.springframework.dao.EmptyResultDataAccessException;
import org.springframework.jdbc.core.JdbcTemplate;
import org.springframework.jdbc.core.RowMapper;
import org.springframework.jdbc.core.namedparam.MapSqlParameterSource;
import org.springframework.jdbc.core.namedparam.NamedParameterJdbcDaoSupport;
import org.springframework.jdbc.core.simple.ParameterizedRowMapper;
import org.springframework.jdbc.core.simple.SimpleJdbcTemplate;
import org.springframework.jdbc.core.namedparam.NamedParameterJdbcTemplate;
import org.springframework.jdbc.support.GeneratedKeyHolder;
import org.springframework.jdbc.support.KeyHolder;

Expand All @@ -66,11 +66,11 @@ public class JdbcMessageDAO extends NamedParameterJdbcDaoSupport implements
private static final String RESPONSE_HEADER_TIME = "headerTime";
private static final String RESPONSE_CONTENT_TIME = "contentTime";

private static final ParameterizedRowMapper<MutableBufferedRequest> REQUEST_MAPPER = new RequestMapper();
private static final ParameterizedRowMapper<MutableBufferedResponse> RESPONSE_MAPPER = new ResponseMapper();
private static final ParameterizedRowMapper<byte[]> CONTENT_MAPPER = new ContentMapper();
private static final ParameterizedRowMapper<Integer> ID_MAPPER = new IdMapper();
private static final ParameterizedRowMapper<Conversation> CONVERSATION_MAPPER = new ConversationMapper();
private static final RowMapper<MutableBufferedRequest> REQUEST_MAPPER = new RequestMapper();
private static final RowMapper<MutableBufferedResponse> RESPONSE_MAPPER = new ResponseMapper();
private static final RowMapper<byte[]> CONTENT_MAPPER = new ContentMapper();
private static final RowMapper<Integer> ID_MAPPER = new IdMapper();
private static final RowMapper<Conversation> CONVERSATION_MAPPER = new ConversationMapper();

private final static String INSERT_CONTENT = "INSERT INTO contents (content, size) VALUES (:content, :size)";

Expand Down Expand Up @@ -188,9 +188,8 @@ public Collection<Integer> listConversationsSince(int id)
MapSqlParameterSource params = new MapSqlParameterSource();
try {
params.addValue(ID, id, Types.INTEGER);
SimpleJdbcTemplate template = new SimpleJdbcTemplate(
getNamedParameterJdbcTemplate());
return template.query(SELECT_CONVERSATIONS, ID_MAPPER, params);
NamedParameterJdbcTemplate template = getNamedParameterJdbcTemplate();
return template.query(SELECT_CONVERSATIONS, params, ID_MAPPER);
} catch (EmptyResultDataAccessException erdae) {
return Collections.emptyList();
}
Expand All @@ -205,9 +204,8 @@ public int getMessageContentId(int headerId) throws DataAccessException {
try {
MapSqlParameterSource params = new MapSqlParameterSource();
params.addValue(ID, headerId, Types.INTEGER);
SimpleJdbcTemplate template = new SimpleJdbcTemplate(
getNamedParameterJdbcTemplate());
return template.queryForInt(SELECT_CONTENT_ID, params);
NamedParameterJdbcTemplate template = getNamedParameterJdbcTemplate();
return template.queryForObject(SELECT_CONTENT_ID, params, Integer.class);
} catch (EmptyResultDataAccessException erdae) {
return -1;
}
Expand All @@ -222,9 +220,8 @@ public int getMessageContentSize(int id) throws DataAccessException {
try {
MapSqlParameterSource params = new MapSqlParameterSource();
params.addValue(ID, id, Types.INTEGER);
SimpleJdbcTemplate template = new SimpleJdbcTemplate(
getNamedParameterJdbcTemplate());
return template.queryForInt(SELECT_CONTENT_SIZE, params);
NamedParameterJdbcTemplate template = getNamedParameterJdbcTemplate();
return template.queryForObject(SELECT_CONTENT_SIZE, params, Integer.class);
} catch (EmptyResultDataAccessException erdae) {
return -1;
}
Expand All @@ -239,10 +236,8 @@ public Conversation getConversation(int id) throws DataAccessException {
try {
MapSqlParameterSource params = new MapSqlParameterSource();
params.addValue(ID, id, Types.INTEGER);
SimpleJdbcTemplate template = new SimpleJdbcTemplate(
getNamedParameterJdbcTemplate());
return template.queryForObject(SELECT_SUMMARY, CONVERSATION_MAPPER,
params);
NamedParameterJdbcTemplate template = getNamedParameterJdbcTemplate();
return template.queryForObject(SELECT_SUMMARY, params, CONVERSATION_MAPPER);
} catch (EmptyResultDataAccessException erdae) {
return null;
}
Expand Down Expand Up @@ -286,10 +281,8 @@ public byte[] loadMessageContent(int id) throws DataAccessException {
try {
MapSqlParameterSource params = new MapSqlParameterSource();
params.addValue(ID, id, Types.INTEGER);
SimpleJdbcTemplate template = new SimpleJdbcTemplate(
getNamedParameterJdbcTemplate());
return template.queryForObject(SELECT_CONTENT, CONTENT_MAPPER,
params);
NamedParameterJdbcTemplate template = getNamedParameterJdbcTemplate();
return template.queryForObject(SELECT_CONTENT, params, CONTENT_MAPPER);
} catch (EmptyResultDataAccessException erdae) {
return null;
}
Expand Down Expand Up @@ -319,10 +312,8 @@ public RequestHeader loadRequestHeader(int id) throws DataAccessException {
MapSqlParameterSource params = new MapSqlParameterSource();
try {
params.addValue(ID, id, Types.INTEGER);
SimpleJdbcTemplate template = new SimpleJdbcTemplate(
getNamedParameterJdbcTemplate());
return template.queryForObject(SELECT_REQUEST, REQUEST_MAPPER,
params);
NamedParameterJdbcTemplate template = getNamedParameterJdbcTemplate();
return template.queryForObject(SELECT_REQUEST, params, REQUEST_MAPPER);
} catch (EmptyResultDataAccessException erdae) {
return null;
}
Expand Down Expand Up @@ -354,10 +345,8 @@ public MutableResponseHeader loadResponseHeader(int id)
try {
MapSqlParameterSource params = new MapSqlParameterSource();
params.addValue(ID, id, Types.INTEGER);
SimpleJdbcTemplate template = new SimpleJdbcTemplate(
getNamedParameterJdbcTemplate());
return template.queryForObject(SELECT_RESPONSE, RESPONSE_MAPPER,
params);
NamedParameterJdbcTemplate template = getNamedParameterJdbcTemplate();
return template.queryForObject(SELECT_RESPONSE, params, RESPONSE_MAPPER);
} catch (EmptyResultDataAccessException erdae) {
return null;
}
Expand Down Expand Up @@ -478,7 +467,7 @@ private void saveMessageHeader(MutableMessageHeader header, int contentId) {
}

private static class RequestMapper implements
ParameterizedRowMapper<MutableBufferedRequest> {
RowMapper<MutableBufferedRequest> {

public MutableBufferedRequest mapRow(ResultSet rs, int rowNum)
throws SQLException {
Expand All @@ -504,7 +493,7 @@ public MutableBufferedRequest mapRow(ResultSet rs, int rowNum)
}

private static class ResponseMapper implements
ParameterizedRowMapper<MutableBufferedResponse> {
RowMapper<MutableBufferedResponse> {

public MutableBufferedResponse mapRow(ResultSet rs, int rowNum)
throws SQLException {
Expand All @@ -529,22 +518,22 @@ public MutableBufferedResponse mapRow(ResultSet rs, int rowNum)
}

private static class ContentMapper implements
ParameterizedRowMapper<byte[]> {
RowMapper<byte[]> {

public byte[] mapRow(ResultSet rs, int rowNum) throws SQLException {
return rs.getBytes(CONTENT);
}
}

private static class IdMapper implements ParameterizedRowMapper<Integer> {
private static class IdMapper implements RowMapper<Integer> {

public Integer mapRow(ResultSet rs, int rowNum) throws SQLException {
return Integer.valueOf(rs.getInt(ID));
}
}

private static class ConversationMapper implements
ParameterizedRowMapper<Conversation> {
RowMapper<Conversation> {

public Conversation mapRow(ResultSet rs, int rowNum)
throws SQLException {
Expand Down
8 changes: 2 additions & 6 deletions ...y-parent/owasp-proxy/src/main/java/org/owasp/proxy/util/BouncyCastleCertificateUtils.java
View file
Original file line number Diff line number Diff line change
Expand Up @@ -34,14 +34,10 @@

import javax.security.auth.x500.X500Principal;

import org.bouncycastle.asn1.x509.BasicConstraints;
import org.bouncycastle.asn1.x509.ExtendedKeyUsage;
import org.bouncycastle.asn1.x509.KeyPurposeId;
import org.bouncycastle.asn1.x509.X509Extensions;
import org.bouncycastle.asn1.x509.*;
import org.bouncycastle.jce.X509KeyUsage;
import org.bouncycastle.x509.X509V3CertificateGenerator;
import org.bouncycastle.x509.extension.AuthorityKeyIdentifierStructure;
import org.bouncycastle.x509.extension.SubjectKeyIdentifierStructure;

@SuppressWarnings("deprecation")
public class BouncyCastleCertificateUtils {
Expand Down Expand Up @@ -116,7 +112,7 @@ private static void addCertificateExtensions(PublicKey pubKey,
// new SubjectKeyIdentifierExtension(new KeyIdentifier(pubKey)
// .getIdentifier()));
certGen.addExtension(X509Extensions.SubjectKeyIdentifier, false,
new SubjectKeyIdentifierStructure(pubKey));
SubjectKeyIdentifier.getInstance(pubKey));
//
// ext.set(AuthorityKeyIdentifierExtension.NAME,
// new AuthorityKeyIdentifierExtension(
Expand Down

0 comments on commit 8dad027

Please sign in to comment.