airbnb / billow Goto Github PK

Version: 2.20

Pretty sure this bug is caused by not null checking this line: https://github.com/airbnb/billow/blob/master/src/main/java/com/airbnb/billow/ElasticsearchCluster.java#L49

getDedicatedMasterCount() returns Integer object and could be null, so we need to do a null check before assigning to int, otherwise you will see this:

05:37:39.425 [main] ERROR com.airbnb.billow.Main - Failure in main thread, getting out!
java.lang.NullPointerException: null
	at com.airbnb.billow.ElasticsearchCluster.<init>(ElasticsearchCluster.java:49) ~[billow-2.20.jar:na]
	at com.airbnb.billow.AWSDatabase.<init>(AWSDatabase.java:221) ~[billow-2.20.jar:na]
	at com.airbnb.billow.AWSDatabaseHolder.rebuild(AWSDatabaseHolder.java:128) ~[billow-2.20.jar:na]
	at com.airbnb.billow.AWSDatabaseHolder.<init>(AWSDatabaseHolder.java:124) ~[billow-2.20.jar:na]
	at com.airbnb.billow.Main.<init>(Main.java:53) ~[billow-2.20.jar:na]
	at com.airbnb.billow.Main.main(Main.java:130) ~[billow-2.20.jar:na]

Also please audit other similar handling as billow is pretty brittle when some assumptions are not met, eg, there needs to be a user IAM role in an account, there needs to be a RDS/Aurora cluster in the account.

Hi!
I am a staff member of QiAnXin Code Guard. In our open source code detection project, I found a OGNL Expression Injection Vulnerability in "billow". The details are as follows:
In the handleComplexSQS(), the parameters in the request are obtained by getQuery(params),

and finally the listQueuesFromQueryExpression() is passed in, followed by:

Parsing the argument as an OGNL expression!
An attacker can construct an OGNL expression for RCE