svn commit: r1857392 - in /ofbiz/ofbiz-framework/trunk/framework/base/src/main/java/org/apache/ofbiz/base/util: SafeObjectInputStream.java UtilObject.java

Author: jleroux
Date: Fri Apr 12 09:29:03 2019
New Revision: 1857392

URL: http://svn.apache.org/viewvc?rev=1857392&view=rev
Log:
Improved: Improve ObjectInputStream class
(OFBIZ-10837)

Cleans and simplifies things in UtilObject.java and also handles patterns.
That's what we missed most when needing to update.

Fixes typos in SafeObjectInputStream class and add a commented line for a WIP in
resolveProxyClass method

Also includes work done in UtilObject.java for OFBIZ-9855
"Using try-with-resources with File IO Objects."



Modified:
    ofbiz/ofbiz-framework/trunk/framework/base/src/main/java/org/apache/ofbiz/base/util/SafeObjectInputStream.java
    ofbiz/ofbiz-framework/trunk/framework/base/src/main/java/org/apache/ofbiz/base/util/UtilObject.java

Modified: ofbiz/ofbiz-framework/trunk/framework/base/src/main/java/org/apache/ofbiz/base/util/SafeObjectInputStream.java
URL: http://svn.apache.org/viewvc/ofbiz/ofbiz-framework/trunk/framework/base/src/main/java/org/apache/ofbiz/base/util/SafeObjectInputStream.java?rev=1857392&r1=1857391&r2=1857392&view=diff
==============================================================================
--- ofbiz/ofbiz-framework/trunk/framework/base/src/main/java/org/apache/ofbiz/base/util/SafeObjectInputStream.java (original)
+++ ofbiz/ofbiz-framework/trunk/framework/base/src/main/java/org/apache/ofbiz/base/util/SafeObjectInputStream.java Fri Apr 12 09:29:03 2019
@@ -60,9 +60,9 @@ public class SafeObjectInputStream exten
     @Override
     protected Class<?> resolveClass(ObjectStreamClass classDesc) throws IOException, ClassNotFoundException {
         if (!WHITELIST_PATTERN.matcher(classDesc.getName()).find()) {
-            Debug.logWarning("************************Incompatible class: " + classDesc.getName() +
+            Debug.logWarning("***Incompatible class***: " + classDesc.getName() +
                     ". Please see OFBIZ-10837.  Report to dev ML if you use OFBiz without changes. "
-                    + "Else add you class into UtilObject::getObjectException", "SafeObjectInputStream");
+                    + "Else add your class into UtilObject::getObjectException", "SafeObjectInputStream");
             throw new ClassCastException("Incompatible class: " + classDesc.getName());
         }
         
@@ -78,7 +78,8 @@ public class SafeObjectInputStream exten
         for (int i = 0; i < interfaces.length; i++) {
             cinterfaces[i] = classloader.loadClass(interfaces[i]);
         }
-
+        //Proxy.getInvocationHandler(proxy)
+        
         try {
             return Proxy.getProxyClass(classloader, cinterfaces);
         } catch (IllegalArgumentException e) {

Modified: ofbiz/ofbiz-framework/trunk/framework/base/src/main/java/org/apache/ofbiz/base/util/UtilObject.java
URL: http://svn.apache.org/viewvc/ofbiz/ofbiz-framework/trunk/framework/base/src/main/java/org/apache/ofbiz/base/util/UtilObject.java?rev=1857392&r1=1857391&r2=1857392&view=diff
==============================================================================
--- ofbiz/ofbiz-framework/trunk/framework/base/src/main/java/org/apache/ofbiz/base/util/UtilObject.java (original)
+++ ofbiz/ofbiz-framework/trunk/framework/base/src/main/java/org/apache/ofbiz/base/util/UtilObject.java Fri Apr 12 09:29:03 2019
@@ -44,65 +44,27 @@ public final class UtilObject {
     public static byte[] getBytes(InputStream is) {
         byte[] buffer = new byte[4 * 1024];
         byte[] data = null;
-        try {
-            ByteArrayOutputStream bos = new ByteArrayOutputStream();
-            try {
-
-                int numBytesRead;
-                while ((numBytesRead = is.read(buffer)) != -1) {
-                    bos.write(buffer, 0, numBytesRead);
-                }
-                data = bos.toByteArray();
-            } finally {
-                bos.close();
+        try (ByteArrayOutputStream bos = new ByteArrayOutputStream()){
+            int numBytesRead;
+            while ((numBytesRead = is.read(buffer)) != -1) {
+                bos.write(buffer, 0, numBytesRead);
             }
+            data = bos.toByteArray();
         } catch (IOException e) {
             Debug.logError(e, module);
-        } finally {
-            try {
-                if (is != null) {
-                    is.close();
-                }
-            } catch (IOException e) {
-                Debug.logError(e, module);
-            }
         }
-
         return data;
     }
 
     /** Serialize an object to a byte array */
     public static byte[] getBytes(Object obj) {
         byte[] data = null;
-        try {
-            ByteArrayOutputStream bos = new ByteArrayOutputStream();
-            try {
-                ObjectOutputStream oos = new ObjectOutputStream(bos);
-                try {
-                    oos.writeObject(obj);
-                    data = bos.toByteArray();
-                } catch (IOException e) {
-                    Debug.logError(e, module);
-                } finally {
-                    oos.flush();
-                    oos.close();
-                }
-            } catch (IOException e) {
-                // I don't know how to force an error during flush or
-                // close of ObjectOutputStream; since OOS is wrapping
-                // BAOS, and BAOS does not throw IOException during
-                // write, I don't think this can happen.
-                Debug.logError(e, module);
-            } finally {
-                bos.close();
-            }
+        try (ByteArrayOutputStream bos = new ByteArrayOutputStream(); ObjectOutputStream oos = new ObjectOutputStream(bos)) {
+            oos.writeObject(obj);
+            data = bos.toByteArray();
         } catch (IOException e) {
-            // How could this ever happen?  BAOS.close() is listed as
-            // throwing the exception, but I don't understand why this
-            // is.
             Debug.logError(e, module);
         }
-
         return data;
     }
 
@@ -142,14 +104,10 @@ public final class UtilObject {
         try (ByteArrayInputStream bis = new ByteArrayInputStream(bytes);
                 SafeObjectInputStream wois = new SafeObjectInputStream(bis,
                         Thread.currentThread().getContextClassLoader(),
-                        java.util.Arrays.asList("byte\\[\\]", "Number", "Long", "foo", "SerializationInjector",
-                                "java.util.HashMap", "Boolean", "Number", "Integer", "FlexibleStringExpander",
-                                "sun.util.calendar.ZoneInfo", "java.sql.Timestamp", "java.util.Date",
-                                "java.math.BigDecimal", "\\[Z","\\[B","\\[S","\\[I","\\[J","\\[F","\\[D","\\[C",
-                                "org.apache.ofbiz.widget.renderer.VisualTheme",
-                                "org.apache.ofbiz.widget.model.ModelTheme",
-                                "java.util.Collections", "java.util.LinkedList", "java.util.ArrayList",
-                                "java.util.TimeZone"));) {
+                        java.util.Arrays.asList("byte\\[\\]", "foo", "SerializationInjector",
+                                "\\[Z","\\[B","\\[S","\\[I","\\[J","\\[F","\\[D","\\[C",
+                                "java..*", "sun.util.calendar..*", "org.apache.ofbiz..*"));) {
+                        // "foo" and, "SerializationInjector" are used in UtilObjectTests::testGetObject
             return wois.readObject();
         }
     }