svn commit: r1869004 - in /ofbiz/ofbiz-framework/trunk: build.gradle framework/base/src/main/java/org/apache/ofbiz/base/util/SafeObjectInputStream.java framework/base/src/main/java/org/apache/ofbiz/base/util/UtilObject.java

[mthl]

Author: mthl
Date: Sat Oct 26 15:17:56 2019
New Revision: 1869004

URL: http://svn.apache.org/viewvc?rev=1869004&view=rev
Log:
Improved: Refactor ‘UtilObject#getObjectException’
(OFBIZ-11261)

This moves most of the behavior inside the ‘SafeObjectInputStream’
class which has been refactored too.

Modified:
    ofbiz/ofbiz-framework/trunk/build.gradle
    ofbiz/ofbiz-framework/trunk/framework/base/src/main/java/org/apache/ofbiz/base/util/SafeObjectInputStream.java
    ofbiz/ofbiz-framework/trunk/framework/base/src/main/java/org/apache/ofbiz/base/util/UtilObject.java

Modified: ofbiz/ofbiz-framework/trunk/build.gradle
URL: http://svn.apache.org/viewvc/ofbiz/ofbiz-framework/trunk/build.gradle?rev=1869004&r1=1869003&r2=1869004&view=diff
==============================================================================
--- ofbiz/ofbiz-framework/trunk/build.gradle (original)
+++ ofbiz/ofbiz-framework/trunk/build.gradle Sat Oct 26 15:17:56 2019
@@ -307,7 +307,7 @@ checkstyle {
     // the sum of errors that were present before introducing the
     // ‘checkstyle’ tool present in the framework and in the official
     // plugins.
-    maxErrors = 37880
+    maxErrors = 37864
     // Currently there are a lot of errors so we need to temporarily
     // hide them to avoid polluting the terminal output.
     showViolations = false

Modified: ofbiz/ofbiz-framework/trunk/framework/base/src/main/java/org/apache/ofbiz/base/util/SafeObjectInputStream.java
URL: http://svn.apache.org/viewvc/ofbiz/ofbiz-framework/trunk/framework/base/src/main/java/org/apache/ofbiz/base/util/SafeObjectInputStream.java?rev=1869004&r1=1869003&r2=1869004&view=diff
==============================================================================
--- ofbiz/ofbiz-framework/trunk/framework/base/src/main/java/org/apache/ofbiz/base/util/SafeObjectInputStream.java (original)
+++ ofbiz/ofbiz-framework/trunk/framework/base/src/main/java/org/apache/ofbiz/base/util/SafeObjectInputStream.java Sat Oct 26 15:17:56 2019
@@ -1,4 +1,4 @@
-/*******************************************************************************
+/*
  * Licensed to the Apache Software Foundation (ASF) under one
  * or more contributor license agreements.  See the NOTICE file
  * distributed with this work for additional information
@@ -15,77 +15,61 @@
  * KIND, either express or implied.  See the License for the
  * specific language governing permissions and limitations
  * under the License.
- *******************************************************************************/
+ */
 package org.apache.ofbiz.base.util;
 
+import static java.util.stream.Collectors.collectingAndThen;
+import static java.util.stream.Collectors.joining;
+import static org.apache.ofbiz.base.util.UtilProperties.getPropertyValue;
+
 import java.io.IOException;
 import java.io.InputStream;
+import java.io.ObjectInputStream;
 import java.io.ObjectStreamClass;
-import java.lang.reflect.Proxy;
-import java.util.List;
+import java.util.Arrays;
 import java.util.regex.Pattern;
 
 /**
- * ObjectInputStream
+ * SafeObjectInputStream
  *
+ * <p> An implementation of {@link java.io.ObjectInputStream} that ensure that
+ * only authorized class can be read from it.
  */
-public class SafeObjectInputStream extends java.io.ObjectInputStream {
-
-    private ClassLoader classloader;
-    private Pattern WHITELIST_PATTERN = null;
+public final class SafeObjectInputStream extends ObjectInputStream {
+    private static final String[] DEFAULT_WHITELIST_PATTERN = {
+            "byte\\[\\]", "foo", "SerializationInjector",
+            "\\[Z", "\\[B", "\\[S", "\\[I", "\\[J", "\\[F", "\\[D", "\\[C",
+            "java..*", "sun.util.calendar..*", "org.apache.ofbiz..*" };
 
-    public SafeObjectInputStream(InputStream in, ClassLoader loader) throws IOException {
-        super(in);
-        this.classloader = loader;
-    }
+    /** The regular expression used to match serialized types. */
+    private final Pattern whitelistPattern;
 
-    public SafeObjectInputStream(InputStream in, ClassLoader loader, List<String> whitelist) throws IOException {
+    /**
+     * Instantiates a safe object input stream.
+     *
+     * @param in  the input stream to read
+     * @throws IOException when reading is not possible.
+     */
+    public SafeObjectInputStream(InputStream in) throws IOException {
         super(in);
-        this.classloader = loader;
-        StringBuilder bld = new StringBuilder("(");
-        for (int i = 0; i < whitelist.size(); i++) {
-            bld.append(whitelist.get(i));
-            if (i != whitelist.size() - 1) {
-                bld.append("|");
-            }
-        }
-        bld.append(")");
-        WHITELIST_PATTERN = Pattern.compile(bld.toString());
+        String safeObjectsProp = getPropertyValue("SafeObjectInputStream", "ListOfSafeObjectsForInputStream");
+        String[] whitelist = safeObjectsProp.isEmpty() ? DEFAULT_WHITELIST_PATTERN : safeObjectsProp.split(",");
+        whitelistPattern = Arrays.stream(whitelist)
+                .map(String::trim)
+                .filter(str -> !str.isEmpty())
+                .collect(collectingAndThen(joining("|", "(", ")"), Pattern::compile));
     }
 
-
-    /**
-     * @see java.io.ObjectInputStream#resolveClass(java.io.ObjectStreamClass)
-     */
     @Override
     protected Class<?> resolveClass(ObjectStreamClass classDesc) throws IOException, ClassNotFoundException {
-        if (!WHITELIST_PATTERN.matcher(classDesc.getName()).find()) {
-            Debug.logWarning("***Incompatible class***: " + classDesc.getName() +
-                    ". Please see OFBIZ-10837.  Report to dev ML if you use OFBiz without changes. "
-                    + "Else follow https://s.apache.org/45war"
-                    , "SafeObjectInputStream");
+        if (!whitelistPattern.matcher(classDesc.getName()).find()) {
+            Debug.logWarning("***Incompatible class***: "
+                    + classDesc.getName()
+                    + ". Please see OFBIZ-10837.  Report to dev ML if you use OFBiz without changes. "
+                    + "Else follow https://s.apache.org/45war",
+                    "SafeObjectInputStream");
             throw new ClassCastException("Incompatible class: " + classDesc.getName());
         }
-        
-        return ObjectType.loadClass(classDesc.getName(), classloader);
-    }
-
-    /**
-     * @see java.io.ObjectInputStream#resolveProxyClass(java.lang.String[])
-     */
-    @Override
-    protected Class<?> resolveProxyClass(String[] interfaces) throws IOException, ClassNotFoundException {
-        Class<?>[] cinterfaces = new Class<?>[interfaces.length];
-        for (int i = 0; i < interfaces.length; i++) {
-            cinterfaces[i] = classloader.loadClass(interfaces[i]);
-        }
-        //Proxy.getInvocationHandler(proxy)
-        
-        try {
-            return Proxy.getProxyClass(classloader, cinterfaces);
-        } catch (IllegalArgumentException e) {
-            throw new ClassNotFoundException(null, e);
-        }
-
+        return ObjectType.loadClass(classDesc.getName(), Thread.currentThread().getContextClassLoader());
     }
 }

Modified: ofbiz/ofbiz-framework/trunk/framework/base/src/main/java/org/apache/ofbiz/base/util/UtilObject.java
URL: http://svn.apache.org/viewvc/ofbiz/ofbiz-framework/trunk/framework/base/src/main/java/org/apache/ofbiz/base/util/UtilObject.java?rev=1869004&r1=1869003&r2=1869004&view=diff
==============================================================================
--- ofbiz/ofbiz-framework/trunk/framework/base/src/main/java/org/apache/ofbiz/base/util/UtilObject.java (original)
+++ ofbiz/ofbiz-framework/trunk/framework/base/src/main/java/org/apache/ofbiz/base/util/UtilObject.java Sat Oct 26 15:17:56 2019
@@ -23,11 +23,8 @@ import java.io.ByteArrayOutputStream;
 import java.io.IOException;
 import java.io.ObjectOutputStream;
 import java.lang.reflect.Array;
-import java.util.Arrays;
 import java.util.Iterator;
-import java.util.List;
 import java.util.ServiceLoader;
-import java.util.stream.Collectors;
 
 import org.apache.ofbiz.base.lang.Factory;
 import org.apache.ofbiz.base.lang.SourceMonitored;
@@ -86,25 +83,17 @@ public final class UtilObject {
         return obj;
     }
 
-    /** Deserialize a byte array back to an object */
+    /**
+     * Deserializes a byte array back to an object.
+     *
+     * @param bytes  the array of bytes
+     * @return the deserialized object.
+     * @throws ClassNotFoundException when the class can not be deserialized.
+     * @throws IOException when a general Input/Output error happen.
+     */
     public static Object getObjectException(byte[] bytes) throws ClassNotFoundException, IOException {
-        String listOfSafeObjectsForInputStream = UtilProperties.getPropertyValue("SafeObjectInputStream",
-                "ListOfSafeObjectsForInputStream");
-        List<String> listOfSafeObjects = null;
-        if (UtilValidate.isNotEmpty(listOfSafeObjectsForInputStream)) {
-            listOfSafeObjects = Arrays.stream(listOfSafeObjectsForInputStream.split(","))
-                    .map(String::trim)
-                    .filter(s -> !s.isEmpty())
-                    .collect(Collectors.toList());
-        } else {
-            listOfSafeObjects = java.util.Arrays.asList("byte\\[\\]", "foo", "SerializationInjector",
-                    "\\[Z","\\[B","\\[S","\\[I","\\[J","\\[F","\\[D","\\[C",
-                    "java..*", "sun.util.calendar..*", "org.apache.ofbiz..*");
-        } // "foo" and, "SerializationInjector" are used in UtilObjectTests::testGetObject
-        
-        ClassLoader classloader = Thread.currentThread().getContextClassLoader();
         try (ByteArrayInputStream bis = new ByteArrayInputStream(bytes);
-             SafeObjectInputStream wois = new SafeObjectInputStream(bis, classloader, listOfSafeObjects)) {
+                SafeObjectInputStream wois = new SafeObjectInputStream(bis)) {
             return wois.readObject();
         }
     }