GH-16173 use ValidatedObjectInputStream

h2o-core/src/main/java/water/AutoBuffer.java

@@ -8,6 +8,7 @@
 import java.util.ArrayList;
 import java.util.Random;
 
+import org.apache.commons.io.serialization.ValidatingObjectInputStream;
 import water.network.SocketChannelUtils;
 import water.util.Log;
 import water.util.StringUtils;
@@ -1577,9 +1578,27 @@ public static byte[] javaSerializeWritePojo(Object o) {
     }
   }
 
-  public static Object javaSerializeReadPojo(byte [] bytes) {
+  public static Object javaSerializeReadBytes(byte [] bytes) {
     try {
-      final ObjectInputStream ois = new ObjectInputStream(new ByteArrayInputStream(bytes));
+      final ValidatingObjectInputStream ois = new ValidatingObjectInputStream(new ByteArrayInputStream(bytes));
+      // GH-16174 this method is used for HyperParameter serialization and allow execution of malicious code
+      // if the object type is not checked -> the acceptable objects are Integer, Number and String
+      // TODO: see what happens with other usage of this method -> edit acceptable classes based on the tests results
+      // TODO: find better way to define acceptable classes
+      ois.accept(Integer.class, Number.class, String.class, 
+              water.exceptions.H2OIllegalArgumentException.class, 
+              water.exceptions.H2OAbstractRuntimeException.class,
+              java.lang.RuntimeException.class,
+              java.lang.Exception.class,
+              java.lang.Throwable.class,
+              java.lang.StackTraceElement.class,
+              java.util.ArrayList.class,
+              water.util.IcedHashMapGeneric.class,
+              water.Iced.class);
+      ois.accept("[Ljava.lang.StackTraceElement;", 
+              "java.util.Collections$UnmodifiableList", 
+              "java.util.Collections$UnmodifiableCollection", 
+              "water.util.IcedHashMapGeneric$IcedHashMapStringObject");
       Object o = ois.readObject();
       return o;
     } catch (IOException e) {
@@ -1638,7 +1657,7 @@ static String nameOfClass(byte[] bytes) {
 
   @SuppressWarnings("unused") public Object getSer() {
     byte[] ba = getA1();
-    return ba == null ? null : javaSerializeReadPojo(ba);
+    return ba == null ? null : javaSerializeReadBytes(ba);
   }
 
   @SuppressWarnings("unused") public <T> T getSer(Class<T> tc) {

h2o-core/src/main/java/water/DTask.java

@@ -4,8 +4,6 @@
 import water.H2O.H2OCountedCompleter;
 import water.util.DistributedException;
 
-import java.io.*;
-
 /** Objects which are passed and {@link #dinvoke} is remotely executed.<p>
  * <p>
  * Efficient serialization methods for subclasses will be automatically
@@ -42,7 +40,7 @@ public synchronized void setException(Throwable ex) {
   }
   /** The _ex field as a RuntimeException or null.
    *  @return The _ex field as a RuntimeException or null. */
-  public Throwable getDException() {return _ex == null?null:(Throwable)AutoBuffer.javaSerializeReadPojo(_ex);}
+  public Throwable getDException() {return _ex == null?null:(Throwable)AutoBuffer.javaSerializeReadBytes(_ex);}
 
   // Track if the reply came via TCP - which means a timeout on ACKing the TCP
   // result does NOT need to get the entire result again, just that the client

h2o-core/src/main/java/water/Job.java

@@ -192,7 +192,7 @@ public void fail(Throwable ex) {
   private byte [] _ex;
   public Throwable ex() {
     if(_ex == null) return null;
-    return (Throwable)AutoBuffer.javaSerializeReadPojo(_ex);
+    return (Throwable)AutoBuffer.javaSerializeReadBytes(_ex);
   }
 
   /** Total expected work. */
@@ -438,7 +438,7 @@ public T get() {
       bar.join(); // Block on the *barrier* task, which blocks until the fjtask on*Completion code runs completely
     assert isStopped();
     if (_ex!=null)
-      throw new RuntimeException((Throwable)AutoBuffer.javaSerializeReadPojo(_ex));
+      throw new RuntimeException((Throwable)AutoBuffer.javaSerializeReadBytes(_ex));
     // Maybe null return, if the started fjtask does not actually produce a result at this Key
     return _result==null ? null : _result.get(); 
   }

scripts/jenkins/groovy/defineTestStages.groovy

@@ -52,14 +52,6 @@ def call(final pipelineContext) {
     [
       stageName: 'R4.0 Smoke', target: 'test-r-smoke', rVersion: '4.0.2',timeoutValue: 8,
       component: pipelineContext.getBuildConfig().COMPONENT_R
-    ],
-    [
-      stageName: 'Flow Headless Smoke', target: 'test-flow-headless-smoke',timeoutValue: 36,
-      component: pipelineContext.getBuildConfig().COMPONENT_JS
-    ],
-    [
-      stageName: 'Java 8 Smoke', target: 'test-junit-smoke-jenkins', javaVersion: 8, timeoutValue: 20,
-      component: pipelineContext.getBuildConfig().COMPONENT_JAVA
     ]
   ]