You are viewing a plain text version of this content. The canonical link for it is here.
Posted to notifications@logging.apache.org by "ppkarwasz (via GitHub)" <gi...@apache.org> on 2024/02/02 13:05:14 UTC
[PR] [LOG4J2-3680] Allow deserialization of arrays (logging-log4j2)
ppkarwasz opened a new pull request, #2259:
URL: https://github.com/apache/logging-log4j2/pull/2259
The `DefaultObjectInputFilter` is too restrictive and it does not allow the deserialization of **arrays** of whitelisted classes.
Most notably `RuntimeException` can not be deserialized, since it contains an array of `StackTraceElement`s. Both classes are allowed, but deserialization of the `StackTraceElement[]` array fails.
We also replace all manual serializations/deserializations in test classes to calls to `SerialUtil`. This guarantees a consistent behavior of all tests under Java 8 and Java 9+.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@logging.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] [LOG4J2-3680] Allow deserialization of arrays (logging-log4j2)
Posted by "vy (via GitHub)" <gi...@apache.org>.
vy commented on code in PR #2259:
URL: https://github.com/apache/logging-log4j2/pull/2259#discussion_r1478875579
##########
log4j-api/src/main/java/org/apache/logging/log4j/util/internal/SerializationUtil.java:
##########
@@ -133,5 +139,62 @@ public static void assertFiltered(final java.io.ObjectInputStream stream) {
}
}
+ /**
+ * Gets the class name of an array component recursively.
+ * <p>
+ * If {@code clazz} is not an array class its name is returned.
+ * </p>
+ * @param clazz the binary name of a class.
+ */
+ public static String stripArray(final Class<?> clazz) {
+ Class<?> currentClazz = clazz;
+ while (currentClazz.isArray()) {
+ currentClazz = currentClazz.getComponentType();
+ }
+ return currentClazz.getName();
+ }
+
+ /**
+ * Gets the class name of an array component recursively.
+ * <p>
+ * If {@code name} is not the name of an array class it is returned unchanged.
+ * </p>
+ * @param name the name of a class.
+ * @see Class#getName()
+ */
+ public static String stripArray(final String name) {
+ int offset;
+ for (offset = 0; offset < name.length() && name.charAt(offset) == '['; offset++) {}
+ if (offset == 0) {
+ return name;
+ }
+ // Reference types
+ if (name.charAt(offset) == 'L') {
+ return name.substring(offset + 1, name.length() - 1);
+ }
+ // Primitive classes
+ switch (name.substring(offset)) {
+ case "Z":
+ return "boolean";
+ case "B":
+ return "byte";
+ case "C":
+ return "char";
+ case "D":
+ return "double";
+ case "F":
+ return "float";
+ case "I":
+ return "int";
+ case "J":
+ return "long";
+ case "S":
+ return "short";
+ default:
Review Comment:
Shouldn't we be throwing an exception? In particular, we are in pretty dangerous waters of serialization...
##########
log4j-api/src/main/java/org/apache/logging/log4j/util/internal/SerializationUtil.java:
##########
@@ -133,5 +139,62 @@ public static void assertFiltered(final java.io.ObjectInputStream stream) {
}
}
+ /**
+ * Gets the class name of an array component recursively.
+ * <p>
+ * If {@code clazz} is not an array class its name is returned.
+ * </p>
+ * @param clazz the binary name of a class.
+ */
+ public static String stripArray(final Class<?> clazz) {
+ Class<?> currentClazz = clazz;
+ while (currentClazz.isArray()) {
+ currentClazz = currentClazz.getComponentType();
+ }
+ return currentClazz.getName();
+ }
+
+ /**
+ * Gets the class name of an array component recursively.
+ * <p>
+ * If {@code name} is not the name of an array class it is returned unchanged.
+ * </p>
+ * @param name the name of a class.
+ * @see Class#getName()
+ */
+ public static String stripArray(final String name) {
+ int offset;
+ for (offset = 0; offset < name.length() && name.charAt(offset) == '['; offset++) {}
Review Comment:
Why not simply using `String#indexOf(char)` instead?
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@logging.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] [LOG4J2-3680] Allow deserialization of arrays (logging-log4j2)
Posted by "ppkarwasz (via GitHub)" <gi...@apache.org>.
ppkarwasz merged PR #2259:
URL: https://github.com/apache/logging-log4j2/pull/2259
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@logging.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org