Improved: Improve ObjectInputStream class
Fixes CVE-2019-0189
The white list was still not complete as reported by Rohit at
This adds FlexibleStringExpander
It seems the warning in SafeObjectInputStream::resolveClass is not enough.
Anyway I'll not change it.
Thanks: Rohit Koushal
@@ -142,8 +142,9 @@ public final class UtilObject {
try (ByteArrayInputStream bis = new ByteArrayInputStream(bytes);
SafeObjectInputStream wois = new SafeObjectInputStream(bis,
Thread.currentThread().getContextClassLoader(),
- java.util.Arrays.asList("byte\\[\\]", "Number", "Long", "foo", "SerializationInjector", "java.util.HashMap", "Boolean", "Number", "Integer"));
- ) { // byte[] used in EntityCrypto::doDecrypt, all others used in UtilObjectTests::testGetObject
+ java.util.Arrays.asList("byte\\[\\]", "Number", "Long", "foo", "SerializationInjector",
+ "java.util.HashMap", "Boolean", "Number", "Integer", "FlexibleStringExpander"));) {
+ // byte[] used in EntityCrypto::doDecrypt, all others used in UtilObjectTests::testGetObject
return wois.readObject();
}
}
