You are viewing a plain text version of this content. The canonical link for it is here.
Posted to notifications@ofbiz.apache.org by "Jacques Le Roux (Jira)" <ji...@apache.org> on 2026/05/25 10:26:00 UTC
[jira] [Commented] (OFBIZ-13423) Deserializing ModelPermission.java throws an error
[ https://issues.apache.org/jira/browse/OFBIZ-13423?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=18083266#comment-18083266 ]
Jacques Le Roux commented on OFBIZ-13423:
-----------------------------------------
Hi [~mridulpathak],
Sounds like it indeed (did not test, just looking at the thread above)
> Deserializing ModelPermission.java throws an error
> --------------------------------------------------
>
> Key: OFBIZ-13423
> URL: https://issues.apache.org/jira/browse/OFBIZ-13423
> Project: OFBiz
> Issue Type: Bug
> Components: framework
> Affects Versions: 24.09.06
> Reporter: Mridul Pathak
> Assignee: Mridul Pathak
> Priority: Major
>
> While investigating OFBIZ-2836, I encountered following exception when there is a validation error,
> java.io.InvalidClassException: org.apache.ofbiz.service.ModelPermission; Unauthorized deserialisation attempt
> at org.apache.ofbiz.base.util.SafeObjectInputStream.resolveClass(SafeObjectInputStream.java:102)
> at java.base/java.io.ObjectInputStream.readNonProxyDesc(ObjectInputStream.java:2034)
> at java.base/java.io.ObjectInputStream.readClassDesc(ObjectInputStream.java:1898)
> at java.base/java.io.ObjectInputStream.readOrdinaryObject(ObjectInputStream.java:2224)
> at java.base/java.io.ObjectInputStream.readObject0(ObjectInputStream.java:1733)
> at java.base/java.io.ObjectInputStream$FieldValues.<init>(ObjectInputStream.java:2606)
> at java.base/java.io.ObjectInputStream.readSerialData(ObjectInputStream.java:2457)
> at java.base/java.io.ObjectInputStream.readOrdinaryObject(ObjectInputStream.java:2257)
> at java.base/java.io.ObjectInputStream.readObject0(ObjectInputStream.java:1733)
> at java.base/java.io.ObjectInputStream$FieldValues.<init>(ObjectInputStream.java:2606)
> at java.base/java.io.ObjectInputStream.readSerialData(ObjectInputStream.java:2457)
> at java.base/java.io.ObjectInputStream.readOrdinaryObject(ObjectInputStream.java:2257)
> at java.base/java.io.ObjectInputStream.readObject0(ObjectInputStream.java:1733)
> at java.base/java.io.ObjectInputStream.readObject(ObjectInputStream.java:509)
> at java.base/java.io.ObjectInputStream.readObject(ObjectInputStream.java:467)
> at java.base/java.util.HashMap.readObject(HashMap.java:1552)
> It seems like in OFBIZ-12221, when moving hardcoded denyList to SafeObjectInputStream.properties instead of moving package string (java.rmi) a broader string "rmi" was added to denyList. This in turn denies any class that contains this string, for instance ModelPermission.java.
>
> To reproduce simply hit [https://localhost:8443/example/control/createExample] in the browser.
--
This message was sent by Atlassian Jira
(v8.20.10#820010)