Module io.github.pixee.security
Package io.github.pixee.security

Class JNDI

  • public final class JNDI
extends java.lang.Object
    Offers utilities to defend against JNDI attacks by controlling allowed resources.

    • Nested Class Summary

      Nested Classes 
      Modifier and Type Class Description
      static interface  JNDI.LimitedContext
      A lookalike method for Context that allows sandboxing resolution.

    • Method Summary

      All Methods Static Methods Concrete Methods 
      Modifier and Type Method Description
      static JNDI.LimitedContext limitedContext​(javax.naming.Context context)
      Looks up a resource in the context, only allowing resources non-URL-based resources and "java:" resources.
      static JNDI.LimitedContext limitedContextByProtocol​(javax.naming.Context context, java.util.Set<UrlProtocol> allowedProtocols)
      Looks up a resource in the context, only allowing resources from the specified protocols.
      static JNDI.LimitedContext limitedContextByResourceName​(javax.naming.Context context, java.util.Set<java.lang.String> allowedResourceNames)
      Looks up a resource in the context, only allowing resources with the given names.

      • Methods inherited from class java.lang.Object

        clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

    • Method Detail

      • limitedContext

        public static JNDI.LimitedContext limitedContext​(javax.naming.Context context)
        Looks up a resource in the context, only allowing resources non-URL-based resources and "java:" resources.

      • limitedContextByProtocol

        public static JNDI.LimitedContext limitedContextByProtocol​(javax.naming.Context context,
                                                           java.util.Set<UrlProtocol> allowedProtocols)
        Looks up a resource in the context, only allowing resources from the specified protocols.

      • limitedContextByResourceName

        public static JNDI.LimitedContext limitedContextByResourceName​(javax.naming.Context context,
                                                               java.util.Set<java.lang.String> allowedResourceNames)
        Looks up a resource in the context, only allowing resources with the given names.