Improved: Improve ObjectInputStream class
Fixes CVE-2019-0189
There was a recurring typo in previous commit.
For arrays of primitives it should be
"\\[Z","\\[B","\\[S","\\[I","\\[J","\\[F","\\[D","\\[C"
and not
"[Z","[B","[S","[I","[J","[F","[D","[C"
It shows how tired I'm :/
@@ -145,7 +145,7 @@ public final class UtilObject {
java.util.Arrays.asList("byte\\[\\]", "Number", "Long", "foo", "SerializationInjector",
"java.util.HashMap", "Boolean", "Number", "Integer", "FlexibleStringExpander",
"sun.util.calendar.ZoneInfo", "java.sql.Timestamp", "java.util.Date",
- "java.math.BigDecimal", "[Z","[B","[S","[I","[J","[F","[D","[C",
+ "java.math.BigDecimal", "\\[Z","\\[B","\\[S","\\[I","\\[J","\\[F","\\[D","\\[C",
"org.apache.ofbiz.widget.renderer.VisualTheme"));) {
return wois.readObject();
}
