(ofbiz-framework) 04/04: Fixed: Extend allowlist in SafeObjectInputStream to include GString* Groovy classes

[ja...@apache.org]

This is an automated email from the ASF dual-hosted git repository.

jacopoc pushed a commit to branch trunk
in repository https://gitbox.apache.org/repos/asf/ofbiz-framework.git

commit 0a2085cb55b8513ca9a922732a759e1688602a53
Author: Jacopo Cappellato <ja...@gmail.com>
AuthorDate: Mon Apr 20 10:19:17 2026 +0200

    Fixed: Extend allowlist in SafeObjectInputStream to include GString* Groovy classes
    
    The classes are also already included in the configurable allow list in SafeObjectInputStream.properties
---
 .../main/java/org/apache/ofbiz/base/util/SafeObjectInputStream.java   | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/framework/base/src/main/java/org/apache/ofbiz/base/util/SafeObjectInputStream.java b/framework/base/src/main/java/org/apache/ofbiz/base/util/SafeObjectInputStream.java
index 88eda3a8ac..aedea1a082 100644
--- a/framework/base/src/main/java/org/apache/ofbiz/base/util/SafeObjectInputStream.java
+++ b/framework/base/src/main/java/org/apache/ofbiz/base/util/SafeObjectInputStream.java
@@ -66,7 +66,9 @@ public final class SafeObjectInputStream extends ObjectInputStream {
             "java\\.util\\.TreeMap",
             "java\\.util\\.Arrays\\$ArrayList",
             "org\\.apache\\.ofbiz\\.entity\\.GenericValue",
-            "org\\.apache\\.ofbiz\\.entity\\.GenericPK"};
+            "org\\.apache\\.ofbiz\\.entity\\.GenericPK",
+            "org\\.codehaus\\.groovy\\.runtime\\.GStringImpl",
+            "groovy\\.lang\\.GString"};
     private static final String[] DEFAULT_DENYLIST = {"rmi", "<"};
 
     /** The regular expression used to match serialized types. */