update security (#1354)

* update security * update security --------- Co-authored-by: liujianjun.ljj <[email protected]>
sofastack · Jul 28, 2023 · a0ea9ed · a0ea9ed
1 parent 742fa90
commit a0ea9ed
Show file tree

Hide file tree

Showing 2 changed files with 11 additions and 0 deletions.
diff --git a/SECURITY.md b/SECURITY.md
@@ -7,3 +7,13 @@ If you have apprehensions regarding SOFAStack's security or you discover vulnera
 In the mail, specify the description of the issue or potential threat. You are also urged to recommend the way to reproduce and replicate the issue. The SOFAStack community will get back to you after assessing and analysing the findings.
 
 PLEASE PAY ATTENTION to report the security issue on the security email before disclosing it on public domain.
+
+## Solution
+
+SOFARPC uses Hessian serialization by default. Hessian is a binary serialization protocol. For more information, please refer to Hessian's [documentation](https://github.com/sofastack/sofa-hessian).
+
+Because of the implement of Hessian, by constructing a specific serialization stream, it may cause arbitrary code execution when doing deserialization. It is recommended that users configure blacklist to solve the problem.
+
+SOFARPC also provides a way to configure blacklists in `BlackListFileLoader`, you can override the blacklist configuration based on the code.
+
+The blacklist built into the project comes from internal practices and external contributions, and is for reference only and is not actively updated, we do not assume any legal responsibility for this.
diff --git a/codec/codec-sofa-hessian/src/main/resources/sofa-rpc/serialize_blacklist.txt b/codec/codec-sofa-hessian/src/main/resources/sofa-rpc/serialize_blacklist.txt
@@ -24,6 +24,7 @@ javax.naming.InitialContext
 javax.naming.spi.ObjectFactory
 javax.script.ScriptEngineManager
 javax.sound.sampled.AudioFormat$Encoding
+javax.sound.sampled.AudioFileFormat
 org.apache.carbondata.core.scan.expression.ExpressionResult
 org.apache.commons.dbcp.datasources.SharedPoolDataSource
 org.apache.ibatis.executor.loader.AbstractSerialStateHolder