svn commit: r1853745 - in /ofbiz/ofbiz-framework/trunk/framework/base/src/main/java/org/apache/ofbiz/base/util: SafeObjectInputStream.java UtilObject.java

Author: jleroux
Date: Sun Feb 17 12:38:06 2019
New Revision: 1853745

URL: http://svn.apache.org/viewvc?rev=1853745&view=rev
Log:
Improved: Improve ObjectInputStream class
(OFBIZ-10837)

The white list I used was not complete.
This adds "java.util.HashMap", "Boolean", "Number", "Integer" which are the ones
missing I found so far.
Maybe other classes could still miss OOTB. So I added a warning in
SafeObjectInputStream::resolveClass

Modified:
    ofbiz/ofbiz-framework/trunk/framework/base/src/main/java/org/apache/ofbiz/base/util/SafeObjectInputStream.java
    ofbiz/ofbiz-framework/trunk/framework/base/src/main/java/org/apache/ofbiz/base/util/UtilObject.java

Modified: ofbiz/ofbiz-framework/trunk/framework/base/src/main/java/org/apache/ofbiz/base/util/SafeObjectInputStream.java
URL: http://svn.apache.org/viewvc/ofbiz/ofbiz-framework/trunk/framework/base/src/main/java/org/apache/ofbiz/base/util/SafeObjectInputStream.java?rev=1853745&r1=1853744&r2=1853745&view=diff
==============================================================================
--- ofbiz/ofbiz-framework/trunk/framework/base/src/main/java/org/apache/ofbiz/base/util/SafeObjectInputStream.java (original)
+++ ofbiz/ofbiz-framework/trunk/framework/base/src/main/java/org/apache/ofbiz/base/util/SafeObjectInputStream.java Sun Feb 17 12:38:06 2019
@@ -60,6 +60,9 @@ public class SafeObjectInputStream exten
     @Override
     protected Class<?> resolveClass(ObjectStreamClass classDesc) throws IOException, ClassNotFoundException {
         if (!WHITELIST_PATTERN.matcher(classDesc.getName()).find()) {
+            Debug.logWarning("************************Incompatible class: " + classDesc.getName() +
+                    ". Please see OFBIZ-10837.  Report to dev ML if you use OFBiz without changes. "
+                    + "Else add you class into UtilObject::getObjectException", "SafeObjectInputStream");
             throw new ClassCastException("Incompatible class: " + classDesc.getName());
         }
         

Modified: ofbiz/ofbiz-framework/trunk/framework/base/src/main/java/org/apache/ofbiz/base/util/UtilObject.java
URL: http://svn.apache.org/viewvc/ofbiz/ofbiz-framework/trunk/framework/base/src/main/java/org/apache/ofbiz/base/util/UtilObject.java?rev=1853745&r1=1853744&r2=1853745&view=diff
==============================================================================
--- ofbiz/ofbiz-framework/trunk/framework/base/src/main/java/org/apache/ofbiz/base/util/UtilObject.java (original)
+++ ofbiz/ofbiz-framework/trunk/framework/base/src/main/java/org/apache/ofbiz/base/util/UtilObject.java Sun Feb 17 12:38:06 2019
@@ -142,7 +142,7 @@ public final class UtilObject {
         try (ByteArrayInputStream bis = new ByteArrayInputStream(bytes);
                 SafeObjectInputStream wois = new SafeObjectInputStream(bis,
                         Thread.currentThread().getContextClassLoader(),
-                        java.util.Arrays.asList("byte\\[\\]", "Number", "Long", "foo", "SerializationInjector"));
+                        java.util.Arrays.asList("byte\\[\\]", "Number", "Long", "foo", "SerializationInjector", "java.util.HashMap", "Boolean", "Number", "Integer"));
                 ) { // byte[] used in EntityCrypto::doDecrypt, all others used in UtilObjectTests::testGetObject
             return wois.readObject();
         }