[ofbiz-framework] branch release17.12 updated: Fixed: Adds a blacklist (to be renamed soon to denylist) in Java serialisation (OFBIZ-12167)

This is an automated email from the ASF dual-hosted git repository.

jleroux pushed a commit to branch release17.12
in repository https://gitbox.apache.org/repos/asf/ofbiz-framework.git


The following commit(s) were added to refs/heads/release17.12 by this push:
     new 00200bf  Fixed: Adds a blacklist (to be renamed soon to denylist) in Java serialisation (OFBIZ-12167)
00200bf is described below

commit 00200bfaca296991a6d1925423c71d74842882b0
Author: Jacques Le Roux <[hidden email]>
AuthorDate: Fri Feb 5 11:02:28 2021 +0100

    Fixed: Adds a blacklist (to be renamed soon to denylist) in Java serialisation (OFBIZ-12167)
   
    Adds an example based on RMI which is known to be a problem
---
 .../org/apache/ofbiz/base/util/SafeObjectInputStream.java   | 13 +++++++++++--
 1 file changed, 11 insertions(+), 2 deletions(-)

diff --git a/framework/base/src/main/java/org/apache/ofbiz/base/util/SafeObjectInputStream.java b/framework/base/src/main/java/org/apache/ofbiz/base/util/SafeObjectInputStream.java
index d50cfbf..a24e027 100644
--- a/framework/base/src/main/java/org/apache/ofbiz/base/util/SafeObjectInputStream.java
+++ b/framework/base/src/main/java/org/apache/ofbiz/base/util/SafeObjectInputStream.java
@@ -63,9 +63,18 @@ public final class SafeObjectInputStream extends ObjectInputStream {
 
     @Override
     protected Class<?> resolveClass(ObjectStreamClass classDesc) throws IOException, ClassNotFoundException {
-        if (!whitelistPattern.matcher(classDesc.getName()).find()) {
+        String className = classDesc.getName();
+        // BlackList exploits; eg: don't allow RMI here
+        if (className.contains("java.rmi.server")) {
+            Debug.logWarning("***Incompatible class***: "
+                    + classDesc.getName()
+                    + ". java.rmi.server classes are not allowed for security reason",
+                    "SafeObjectInputStream");
+            return null;
+        }
+        if (!whitelistPattern.matcher(className).find()) {
             // DiskFileItem, FileItemHeadersImpl are not serializable.
-            if (classDesc.getName().contains("org.apache.commons.fileupload")) {
+            if (className.contains("org.apache.commons.fileupload")) {
                 return null;
             }
             Debug.logWarning("***Incompatible class***: "