Improved: Improve ObjectInputStream denyList
Prevents generics markup in string type names.
@@ -64,8 +64,9 @@ public final class SafeObjectInputStream extends ObjectInputStream {
@Override
protected Class<?> resolveClass(ObjectStreamClass classDesc) throws IOException, ClassNotFoundException {
String className = classDesc.getName();
- // DenyList exploits; eg: don't allow RMI here
- if (className.contains("java.rmi")) {
+ // DenyList
+ if (className.contains("java.rmi") // Don't allow RMI
+ || className.contains("<")) { // Prevent generics markup in string type names
throw new InvalidClassException(className, "Unauthorized deserialisation attempt");
}
if (!allowlistPattern.matcher(className).find()) {
