Disabling executable instructions from a network message
One or more aspects of the present disclosure relate to disabling executable instructions from a network message. In embodiments, a message can be received at a server. In addition, one or more executable instructions can be disabled from the message. Further, the message with the disabled one or more executable instructions can be processed.
1. A method comprising:
receiving a message at a server;
disabling one or more executable instructions from the message; and
processing the message with the disabled one or more executable instructions, wherein processing the message includes:
removing characters from fields corresponding to one or more predetermined field types, including container field types, wherein container field types include linked hash maps;
recursively processing each container field type; and
reassembling the fields with removed characters into a new container field.
2. The method of claim 1 , further comprising:
receiving the message from an authenticated client, wherein the authenticated client corresponds to a client whose corresponding message includes valid client credentials.
3. The method of claim 1 , wherein the message subscribes to a predetermined format.
4. The method of claim 1 , further comprising:
receiving the message at a Web Application Resource (WAR) interceptor;
redirecting the message to a message converter; and
injecting a security bean into the message converter using an inversion-of-control (IOC) framework, where the IOC framework includes a Contexts and Dependency Injection (CDI) subsystem.
5. The method of claim 4 , further comprising:
serializing the message into a serialized message object, wherein the serialized object is an instance of a server messaging class.
6. The method of claim 5 , further comprising:
analyzing the serialized message object using the security bean; and
disabling auto-executable instructions in the serialized object.
7. The method of claim 6 , further comprising:
examining each class object in the serialized message object using the security bean.
8. The method of claim 7 , further comprising:
identifying each field along an inheritance hierarchy for each class object, wherein identifying each field includes identifying each field's type; and
recursively processing each field based on a structure of each field's type.
9. The method of claim 1 , further comprising:
preventing character removal from fields matching one or more predetermined patterns.
10. A system with a memory and a processor, the system configured to:
receive a message at a server;
disable one or more executable instructions from the message; and
process the message with the disabled one or more executable instructions, wherein processing the message includes:
removing characters from fields corresponding to one or more predetermined field types, including container field types, wherein container field types include linked hash maps;
recursively processing each container field type; and
reassembling the fields with removed characters into a new container field.
11. The system of claim 10 , further configured to:
receive the message from an authenticated client, wherein the authenticated client corresponds to a client whose corresponding message includes valid client credentials.
12. The system of claim 10 , wherein the message subscribes to a predetermined format.
13. The system of claim 10 , further configured to:
receive the message at a Web Application Resource (WAR) interceptor;
redirect the message to a message converter; and
inject a security bean into the message converter using an inversion-of-control (IOC) framework, where the IOC framework includes a Contexts and Dependency Injection (CDI) subsystem.
14. The system of claim 13 , further configured to:
serialize the message into a serialized message object, wherein the serialized object is an instance of a server messaging class.
15. The system of claim 14 , further configured to:
analyze the serialized message object using the security bean; and
disable auto-executable instructions in the serialized object.
16. The system of claim 15 , further configured to:
examine each class object in the serialized message object using the security bean.
17. The system of claim 16 , further configured to:
identify each field along an inheritance hierarchy for each class object, wherein identifying each field includes identifying each field's type; and
recursively process each field based on a structure of each field's type.
18. The system of claim 10 , further configured to:
prevent character removal from fields matching one or more predetermined patterns.