Stop json/plain from allocating arbitrary classes

[d2army]

Summary

COR3-130 · SECBUGS-22434 · SECBUGS-174

Partner write-up: SECBUGS-174 Doc

Encoding name stays json/plain.

Problem

If an attacker can write workflow or activity input to a Temporal namespace your worker reads, they can put JSON in those payloads that names arbitrary Ruby classes. Oj will build those classes during deserialize, before activity code runs.

This is not public-internet RCE. The attacker needs write access to Temporal inputs on a namespace the worker polls.

Solution

This PR blocks that. If the class is not allowed, we raise Temporal::JSONDisallowedClassError before Oj.load. Normal payloads still deserialize: activity ::Request / ::Response types, Exception subclasses, and Temporal:: types. Apps can register more names with Temporal::JSON.allow_class (Transfers does this at boot for V1 domain objects).

We did not switch to plain JSON hashes. Coinbase wire history still needs Oj object mode for Time (^t), symbol keys, and existing ^o / ^u shapes. Instead, deserialize runs three steps, in this order:

1. Streaming walk (Oj::Saj): reject duplicate object keys and nesting deeper than 512. Saj has to run first. JSON.parse keeps the last duplicate key; Oj binds ^o on the first, so a discarded object or array can still allocate a class.
2. Allowlist on the JSON.parse tree: loaded Temporal:: types, loaded ::Request / ::Response, loaded Exception subclasses, Date / DateTime / Rational, Thread::Backtrace (raised exceptions), anonymous Structs, and names registered with Temporal::JSON.allow_class. Constants that are only pending autoload are rejected until they are actually loaded.
3. Oj.load of the original bytes: keep Time (^t) and symbol keys.

Do not tighten ^c. It returns a Class object (not an instance) for any already-loaded constant, which is required when an exception ivar holds a class.

Consumer bake (head 2f791b6)

custody/api#15261 and tx_service#9157 pin this commit on dev and staging. Do not publish 0.0.7 or merge consumer PRs to prod until gem review lands.

How to review

Start here:

1. lib/temporal/json.rb — whole guard. File header is the map. Then PayloadStructureValidator#note (why keys are recorded on hash and array start), then allowed_* / allow_class.
2. lib/temporal/errors.rb — JSONDisallowedClassError.
3. lib/temporal/concerns/input_deserializer.rb — also rescue JSON::ParserError so newline-split Go-client input still works. Do not swallow JSONDisallowedClassError.

Then, only if you are checking packaging or CI:

• temporal.gemspec — google-protobuf ~> 3.25 because generated stubs do not load on protobuf 4.
• .github/workflows/tests.yml — CI now runs on transfers-master PRs (it did not before). docker compose v2, wait-for-7233, and image pins are so example CI actually starts Temporal.
• spec/unit/lib/temporal/json_spec.rb — first-party round-trips that broke on the first fail-closed pass, then attack/duplicate-key regressions.

Test plan

• bundle exec rspec spec/unit (643 examples, 0 failures)
• Gadgets (Gem::Requirement, Kernel) and duplicate keys (both value orderings, including ^u) raise before Oj.load
• Nesting 512 accepted, 513 rejected; autoload-pending constants are not loaded
• Request/Response, exceptions with backtraces, Date, anonymous Struct, json/plain encoding name
• Go-client newline input still deserializes
• GitHub Actions test_gem and test_examples on this PR
• After publish: consumers can pin temporal-ruby 0.0.7 instead of a git SHA