Improved: Improve ObjectInputStream class
Fixes CVE-2019-0189
The white list was still not complete as reported by Wolfgang Rauchholz on user
ML
This adds java.util.Date
It seems the warning in SafeObjectInputStream::resolveClass is not enough.
Anyway I'll not change it.
Thanks: Wolfgang Rauchholz
@@ -144,7 +144,7 @@ public final class UtilObject {
Thread.currentThread().getContextClassLoader(),
java.util.Arrays.asList("byte\\[\\]", "Number", "Long", "foo", "SerializationInjector",
"java.util.HashMap", "Boolean", "Number", "Integer", "FlexibleStringExpander",
- "sun.util.calendar.ZoneInfo", "java.sql.Timestamp"));) {
+ "sun.util.calendar.ZoneInfo", "java.sql.Timestamp", "java.util.Date"));) {
return wois.readObject();
}
}
