You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@commons.apache.org by tn...@apache.org on 2015/11/09 22:09:05 UTC
svn commit: r1713537 - in
/commons/proper/collections/branches/COLLECTIONS_3_2_X/src:
java/org/apache/commons/collections/functors/InvokerTransformer.java
test/org/apache/commons/collections/functors/TestInvokerTransformer.java
Author: tn
Date: Mon Nov 9 21:09:05 2015
New Revision: 1713537
URL: http://svn.apache.org/viewvc?rev=1713537&view=rev
Log:
[COLLECTIONS-580] Add javadoc, improve error message and apply review comments.
Modified:
commons/proper/collections/branches/COLLECTIONS_3_2_X/src/java/org/apache/commons/collections/functors/InvokerTransformer.java
commons/proper/collections/branches/COLLECTIONS_3_2_X/src/test/org/apache/commons/collections/functors/TestInvokerTransformer.java
Modified: commons/proper/collections/branches/COLLECTIONS_3_2_X/src/java/org/apache/commons/collections/functors/InvokerTransformer.java
URL: http://svn.apache.org/viewvc/commons/proper/collections/branches/COLLECTIONS_3_2_X/src/java/org/apache/commons/collections/functors/InvokerTransformer.java?rev=1713537&r1=1713536&r2=1713537&view=diff
==============================================================================
--- commons/proper/collections/branches/COLLECTIONS_3_2_X/src/java/org/apache/commons/collections/functors/InvokerTransformer.java (original)
+++ commons/proper/collections/branches/COLLECTIONS_3_2_X/src/java/org/apache/commons/collections/functors/InvokerTransformer.java Mon Nov 9 21:09:05 2015
@@ -18,6 +18,7 @@ package org.apache.commons.collections.f
import java.io.IOException;
import java.io.ObjectInputStream;
+import java.io.ObjectOutputStream;
import java.io.Serializable;
import java.lang.reflect.InvocationTargetException;
import java.lang.reflect.Method;
@@ -29,6 +30,17 @@ import org.apache.commons.collections.Tr
/**
* Transformer implementation that creates a new object instance by reflection.
+ * <p>
+ * <b>WARNING:</b> from v3.2.2 onwards this class will throw an
+ * {@link UnsupportedOperationException} when trying to de-serialize an
+ * instance from a {@link ObjectOutputStream} to prevent potential
+ * remote code execution exploits.
+ * <p>
+ * In order to re-enable de-serialization of {@code InvokerTransformer}
+ * instances, the following system property can be used (via -Dproperty=true):
+ * <pre>
+ * org.apache.commons.collections.invokertransformer.enableDeserialization
+ * </pre>
*
* @since Commons Collections 3.0
* @version $Revision$ $Date$
@@ -160,8 +172,10 @@ public class InvokerTransformer implemen
deserializeProperty = null;
}
- if (deserializeProperty == null || !deserializeProperty.equalsIgnoreCase("true")) {
- throw new UnsupportedOperationException("Deserialization of InvokerTransformer is disabled, ");
+ if (!"true".equalsIgnoreCase(deserializeProperty)) {
+ throw new UnsupportedOperationException(
+ "Deserialization of InvokerTransformer is disabled for security reasons. " +
+ "To re-enable it set system property '" + DESERIALIZE + "' to 'true'");
}
is.defaultReadObject();
Modified: commons/proper/collections/branches/COLLECTIONS_3_2_X/src/test/org/apache/commons/collections/functors/TestInvokerTransformer.java
URL: http://svn.apache.org/viewvc/commons/proper/collections/branches/COLLECTIONS_3_2_X/src/test/org/apache/commons/collections/functors/TestInvokerTransformer.java?rev=1713537&r1=1713536&r2=1713537&view=diff
==============================================================================
--- commons/proper/collections/branches/COLLECTIONS_3_2_X/src/test/org/apache/commons/collections/functors/TestInvokerTransformer.java (original)
+++ commons/proper/collections/branches/COLLECTIONS_3_2_X/src/test/org/apache/commons/collections/functors/TestInvokerTransformer.java Mon Nov 9 21:09:05 2015
@@ -44,17 +44,19 @@ public class TestInvokerTransformer exte
Assert.assertNull(System.getProperty(InvokerTransformer.DESERIALIZE));
System.setProperty(InvokerTransformer.DESERIALIZE, "true");
- InvokerTransformer transformer = new InvokerTransformer("toString", new Class[0], new Object[0]);
- byte[] data = serialize(transformer);
- Assert.assertNotNull(data);
try {
- Object obj = deserialize(data);
- Assert.assertTrue(obj instanceof InvokerTransformer);
- } catch (UnsupportedOperationException ex) {
- fail("de-serialization of InvokerTransformer should be enabled");
+ InvokerTransformer transformer = new InvokerTransformer("toString", new Class[0], new Object[0]);
+ byte[] data = serialize(transformer);
+ Assert.assertNotNull(data);
+ try {
+ Object obj = deserialize(data);
+ Assert.assertTrue(obj instanceof InvokerTransformer);
+ } catch (UnsupportedOperationException ex) {
+ fail("de-serialization of InvokerTransformer should be enabled");
+ }
+ } finally {
+ System.clearProperty(InvokerTransformer.DESERIALIZE);
}
-
- System.clearProperty(InvokerTransformer.DESERIALIZE);
}
private byte[] serialize(InvokerTransformer transformer) throws IOException {