Improved: Improve ObjectInputStream class
Fixes CVE-2019-0189
The white list was still not complete as reported by Ed Mack
This adds
org.apache.ofbiz.widget.model.ModelTheme
java.util.Collections
java.util.LinkedList
java.util.ArrayList
java.util.TimeZonz
Thanks: Ed Mack at
@@ -146,7 +146,10 @@ public final class UtilObject {
"java.util.HashMap", "Boolean", "Number", "Integer", "FlexibleStringExpander",
"sun.util.calendar.ZoneInfo", "java.sql.Timestamp", "java.util.Date",
"java.math.BigDecimal", "\\[Z","\\[B","\\[S","\\[I","\\[J","\\[F","\\[D","\\[C",
- "org.apache.ofbiz.widget.renderer.VisualTheme"));) {
+ "org.apache.ofbiz.widget.renderer.VisualTheme",
+ "org.apache.ofbiz.widget.model.ModelTheme",
+ "java.util.Collections", "java.util.LinkedList", "java.util.ArrayList",
+ "java.util.TimeZone"));) {
return wois.readObject();
}
}
