(ofbiz-framework) 01/04: Fixed: Remove support for serialization and deserialization of custom Java objects in XmlSerializer for security reasons

[ja...@apache.org]

This is an automated email from the ASF dual-hosted git repository.

jacopoc pushed a commit to branch trunk
in repository https://gitbox.apache.org/repos/asf/ofbiz-framework.git

commit 6e8d8620ac718434a3a40cc9c9d4462392b98a9b
Author: Jacopo Cappellato <ja...@gmail.com>
AuthorDate: Thu Apr 9 09:11:34 2026 +0200

    Fixed: Remove support for serialization and deserialization of custom Java objects in XmlSerializer for security reasons
---
 .../ofbiz/entity/serialize/XmlSerializer.java      | 34 +++++-----------------
 1 file changed, 8 insertions(+), 26 deletions(-)

diff --git a/framework/entity/src/main/java/org/apache/ofbiz/entity/serialize/XmlSerializer.java b/framework/entity/src/main/java/org/apache/ofbiz/entity/serialize/XmlSerializer.java
index 5581c76f26..b20bc313ff 100644
--- a/framework/entity/src/main/java/org/apache/ofbiz/entity/serialize/XmlSerializer.java
+++ b/framework/entity/src/main/java/org/apache/ofbiz/entity/serialize/XmlSerializer.java
@@ -20,7 +20,6 @@ package org.apache.ofbiz.entity.serialize;
 
 import java.io.FileNotFoundException;
 import java.io.IOException;
-import java.io.Serializable;
 import java.lang.ref.WeakReference;
 import java.math.BigDecimal;
 import java.math.RoundingMode;
@@ -48,10 +47,8 @@ import jakarta.xml.bind.DatatypeConverter;
 import javax.xml.parsers.ParserConfigurationException;
 
 import org.apache.ofbiz.base.util.Debug;
-import org.apache.ofbiz.base.util.StringUtil;
 import org.apache.ofbiz.base.util.UtilGenerics;
 import org.apache.ofbiz.base.util.UtilMisc;
-import org.apache.ofbiz.base.util.UtilObject;
 import org.apache.ofbiz.base.util.UtilXml;
 import org.apache.ofbiz.entity.Delegator;
 import org.apache.ofbiz.entity.GenericPK;
@@ -259,18 +256,11 @@ public class XmlSerializer {
     }
 
     public static Element serializeCustom(Object object, Document document) throws SerializeException {
-        if (object instanceof Serializable) {
-            byte[] objBytes = UtilObject.getBytes(object);
-            if (objBytes == null) {
-                throw new SerializeException("Unable to serialize object; null byte array returned");
-            }
-            String byteHex = StringUtil.toHexString(objBytes);
-            Element element = document.createElement("cus-obj");
-            // this is hex encoded so does not need to be in a CDATA block
-            element.appendChild(document.createTextNode(byteHex));
-            return element;
-        }
-        throw new SerializeException("Cannot serialize object of class " + object.getClass().getName());
+        Debug.logError("Serialization of custom Java objects (cus-obj) is no longer supported. "
+                + "This feature has been removed for security reasons. Object class: "
+                + object.getClass().getName(), MODULE);
+        throw new SerializeException("Serialization of custom Java objects is not supported. "
+                + "Object class: " + object.getClass().getName());
     }
 
     public static Element makeElement(String elementName, Object value, Document document) {
@@ -467,17 +457,9 @@ public class XmlSerializer {
     public static Object deserializeCustom(Element element) throws SerializeException {
         String tagName = element.getLocalName();
         if ("cus-obj".equals(tagName)) {
-            String value = UtilXml.elementValue(element);
-            if (value != null) {
-                byte[] valueBytes = StringUtil.fromHexString(value);
-                if (valueBytes != null) {
-                    Object obj = UtilObject.getObject(valueBytes);
-                    if (obj != null) {
-                        return obj;
-                    }
-                }
-            }
-            throw new SerializeException("Problem deserializing object from byte array + " + element.getLocalName());
+            Debug.logError("Deserialization of cus-obj elements is no longer supported. "
+                    + "This feature has been removed for security reasons.", MODULE);
+            throw new SerializeException("Deserialization of cus-obj elements is not supported.");
         }
         throw new SerializeException("Cannot deserialize element named " + element.getLocalName());
     }