You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@ofbiz.apache.org by mt...@apache.org on 2019/10/26 15:17:56 UTC
svn commit: r1869004 - in /ofbiz/ofbiz-framework/trunk: build.gradle
framework/base/src/main/java/org/apache/ofbiz/base/util/SafeObjectInputStream.java
framework/base/src/main/java/org/apache/ofbiz/base/util/UtilObject.java
Author: mthl
Date: Sat Oct 26 15:17:56 2019
New Revision: 1869004
URL: http://svn.apache.org/viewvc?rev=1869004&view=rev
Log:
Improved: Refactor ‘UtilObject#getObjectException’
(OFBIZ-11261)
This moves most of the behavior inside the ‘SafeObjectInputStream’
class which has been refactored too.
Modified:
ofbiz/ofbiz-framework/trunk/build.gradle
ofbiz/ofbiz-framework/trunk/framework/base/src/main/java/org/apache/ofbiz/base/util/SafeObjectInputStream.java
ofbiz/ofbiz-framework/trunk/framework/base/src/main/java/org/apache/ofbiz/base/util/UtilObject.java
Modified: ofbiz/ofbiz-framework/trunk/build.gradle
URL: http://svn.apache.org/viewvc/ofbiz/ofbiz-framework/trunk/build.gradle?rev=1869004&r1=1869003&r2=1869004&view=diff
==============================================================================
--- ofbiz/ofbiz-framework/trunk/build.gradle (original)
+++ ofbiz/ofbiz-framework/trunk/build.gradle Sat Oct 26 15:17:56 2019
@@ -307,7 +307,7 @@ checkstyle {
// the sum of errors that were present before introducing the
// âcheckstyleâ tool present in the framework and in the official
// plugins.
- maxErrors = 37880
+ maxErrors = 37864
// Currently there are a lot of errors so we need to temporarily
// hide them to avoid polluting the terminal output.
showViolations = false
Modified: ofbiz/ofbiz-framework/trunk/framework/base/src/main/java/org/apache/ofbiz/base/util/SafeObjectInputStream.java
URL: http://svn.apache.org/viewvc/ofbiz/ofbiz-framework/trunk/framework/base/src/main/java/org/apache/ofbiz/base/util/SafeObjectInputStream.java?rev=1869004&r1=1869003&r2=1869004&view=diff
==============================================================================
--- ofbiz/ofbiz-framework/trunk/framework/base/src/main/java/org/apache/ofbiz/base/util/SafeObjectInputStream.java (original)
+++ ofbiz/ofbiz-framework/trunk/framework/base/src/main/java/org/apache/ofbiz/base/util/SafeObjectInputStream.java Sat Oct 26 15:17:56 2019
@@ -1,4 +1,4 @@
-/*******************************************************************************
+/*
* Licensed to the Apache Software Foundation (ASF) under one
* or more contributor license agreements. See the NOTICE file
* distributed with this work for additional information
@@ -15,77 +15,61 @@
* KIND, either express or implied. See the License for the
* specific language governing permissions and limitations
* under the License.
- *******************************************************************************/
+ */
package org.apache.ofbiz.base.util;
+import static java.util.stream.Collectors.collectingAndThen;
+import static java.util.stream.Collectors.joining;
+import static org.apache.ofbiz.base.util.UtilProperties.getPropertyValue;
+
import java.io.IOException;
import java.io.InputStream;
+import java.io.ObjectInputStream;
import java.io.ObjectStreamClass;
-import java.lang.reflect.Proxy;
-import java.util.List;
+import java.util.Arrays;
import java.util.regex.Pattern;
/**
- * ObjectInputStream
+ * SafeObjectInputStream
*
+ * <p> An implementation of {@link java.io.ObjectInputStream} that ensure that
+ * only authorized class can be read from it.
*/
-public class SafeObjectInputStream extends java.io.ObjectInputStream {
-
- private ClassLoader classloader;
- private Pattern WHITELIST_PATTERN = null;
+public final class SafeObjectInputStream extends ObjectInputStream {
+ private static final String[] DEFAULT_WHITELIST_PATTERN = {
+ "byte\\[\\]", "foo", "SerializationInjector",
+ "\\[Z", "\\[B", "\\[S", "\\[I", "\\[J", "\\[F", "\\[D", "\\[C",
+ "java..*", "sun.util.calendar..*", "org.apache.ofbiz..*" };
- public SafeObjectInputStream(InputStream in, ClassLoader loader) throws IOException {
- super(in);
- this.classloader = loader;
- }
+ /** The regular expression used to match serialized types. */
+ private final Pattern whitelistPattern;
- public SafeObjectInputStream(InputStream in, ClassLoader loader, List<String> whitelist) throws IOException {
+ /**
+ * Instantiates a safe object input stream.
+ *
+ * @param in the input stream to read
+ * @throws IOException when reading is not possible.
+ */
+ public SafeObjectInputStream(InputStream in) throws IOException {
super(in);
- this.classloader = loader;
- StringBuilder bld = new StringBuilder("(");
- for (int i = 0; i < whitelist.size(); i++) {
- bld.append(whitelist.get(i));
- if (i != whitelist.size() - 1) {
- bld.append("|");
- }
- }
- bld.append(")");
- WHITELIST_PATTERN = Pattern.compile(bld.toString());
+ String safeObjectsProp = getPropertyValue("SafeObjectInputStream", "ListOfSafeObjectsForInputStream");
+ String[] whitelist = safeObjectsProp.isEmpty() ? DEFAULT_WHITELIST_PATTERN : safeObjectsProp.split(",");
+ whitelistPattern = Arrays.stream(whitelist)
+ .map(String::trim)
+ .filter(str -> !str.isEmpty())
+ .collect(collectingAndThen(joining("|", "(", ")"), Pattern::compile));
}
-
- /**
- * @see java.io.ObjectInputStream#resolveClass(java.io.ObjectStreamClass)
- */
@Override
protected Class<?> resolveClass(ObjectStreamClass classDesc) throws IOException, ClassNotFoundException {
- if (!WHITELIST_PATTERN.matcher(classDesc.getName()).find()) {
- Debug.logWarning("***Incompatible class***: " + classDesc.getName() +
- ". Please see OFBIZ-10837. Report to dev ML if you use OFBiz without changes. "
- + "Else follow https://s.apache.org/45war"
- , "SafeObjectInputStream");
+ if (!whitelistPattern.matcher(classDesc.getName()).find()) {
+ Debug.logWarning("***Incompatible class***: "
+ + classDesc.getName()
+ + ". Please see OFBIZ-10837. Report to dev ML if you use OFBiz without changes. "
+ + "Else follow https://s.apache.org/45war",
+ "SafeObjectInputStream");
throw new ClassCastException("Incompatible class: " + classDesc.getName());
}
-
- return ObjectType.loadClass(classDesc.getName(), classloader);
- }
-
- /**
- * @see java.io.ObjectInputStream#resolveProxyClass(java.lang.String[])
- */
- @Override
- protected Class<?> resolveProxyClass(String[] interfaces) throws IOException, ClassNotFoundException {
- Class<?>[] cinterfaces = new Class<?>[interfaces.length];
- for (int i = 0; i < interfaces.length; i++) {
- cinterfaces[i] = classloader.loadClass(interfaces[i]);
- }
- //Proxy.getInvocationHandler(proxy)
-
- try {
- return Proxy.getProxyClass(classloader, cinterfaces);
- } catch (IllegalArgumentException e) {
- throw new ClassNotFoundException(null, e);
- }
-
+ return ObjectType.loadClass(classDesc.getName(), Thread.currentThread().getContextClassLoader());
}
}
Modified: ofbiz/ofbiz-framework/trunk/framework/base/src/main/java/org/apache/ofbiz/base/util/UtilObject.java
URL: http://svn.apache.org/viewvc/ofbiz/ofbiz-framework/trunk/framework/base/src/main/java/org/apache/ofbiz/base/util/UtilObject.java?rev=1869004&r1=1869003&r2=1869004&view=diff
==============================================================================
--- ofbiz/ofbiz-framework/trunk/framework/base/src/main/java/org/apache/ofbiz/base/util/UtilObject.java (original)
+++ ofbiz/ofbiz-framework/trunk/framework/base/src/main/java/org/apache/ofbiz/base/util/UtilObject.java Sat Oct 26 15:17:56 2019
@@ -23,11 +23,8 @@ import java.io.ByteArrayOutputStream;
import java.io.IOException;
import java.io.ObjectOutputStream;
import java.lang.reflect.Array;
-import java.util.Arrays;
import java.util.Iterator;
-import java.util.List;
import java.util.ServiceLoader;
-import java.util.stream.Collectors;
import org.apache.ofbiz.base.lang.Factory;
import org.apache.ofbiz.base.lang.SourceMonitored;
@@ -86,25 +83,17 @@ public final class UtilObject {
return obj;
}
- /** Deserialize a byte array back to an object */
+ /**
+ * Deserializes a byte array back to an object.
+ *
+ * @param bytes the array of bytes
+ * @return the deserialized object.
+ * @throws ClassNotFoundException when the class can not be deserialized.
+ * @throws IOException when a general Input/Output error happen.
+ */
public static Object getObjectException(byte[] bytes) throws ClassNotFoundException, IOException {
- String listOfSafeObjectsForInputStream = UtilProperties.getPropertyValue("SafeObjectInputStream",
- "ListOfSafeObjectsForInputStream");
- List<String> listOfSafeObjects = null;
- if (UtilValidate.isNotEmpty(listOfSafeObjectsForInputStream)) {
- listOfSafeObjects = Arrays.stream(listOfSafeObjectsForInputStream.split(","))
- .map(String::trim)
- .filter(s -> !s.isEmpty())
- .collect(Collectors.toList());
- } else {
- listOfSafeObjects = java.util.Arrays.asList("byte\\[\\]", "foo", "SerializationInjector",
- "\\[Z","\\[B","\\[S","\\[I","\\[J","\\[F","\\[D","\\[C",
- "java..*", "sun.util.calendar..*", "org.apache.ofbiz..*");
- } // "foo" and, "SerializationInjector" are used in UtilObjectTests::testGetObject
-
- ClassLoader classloader = Thread.currentThread().getContextClassLoader();
try (ByteArrayInputStream bis = new ByteArrayInputStream(bytes);
- SafeObjectInputStream wois = new SafeObjectInputStream(bis, classloader, listOfSafeObjects)) {
+ SafeObjectInputStream wois = new SafeObjectInputStream(bis)) {
return wois.readObject();
}
}