Improved: Improve ObjectInputStream class
Fixes CVE-2019-0189
The white list was still not complete as reported by Ed Mack
This adds all arrays of primitives and java.math.BigDecimal
Thanks: Ed Mack at
@@ -145,7 +145,8 @@ public final class UtilObject {
java.util.Arrays.asList("byte\\[\\]", "Number", "Long", "foo", "SerializationInjector",
"java.util.HashMap", "Boolean", "Number", "Integer", "FlexibleStringExpander",
"sun.util.calendar.ZoneInfo", "java.sql.Timestamp", "java.util.Date",
- "java.math.BigDecimal", "\\[B"));) {
+ "java.math.BigDecimal", "[Z ","[B ","[S ","[I ","[J ","[F ","[D ","[C ",
+ "org.apache.ofbiz.widget.renderer.VisualTheme"));) {
return wois.readObject();
}
}
