This is an automated email from the ASF dual-hosted git repository. jacopoc pushed a commit to branch release24.09 in repository https://gitbox.apache.org/repos/asf/ofbiz-framework.git
commit 66f334d5e88251135d546b04b2d0ee632a066645 Author: Jacopo Cappellato <[email protected]> AuthorDate: Sun May 10 09:30:45 2026 +0200 Fixed: Add sun.util.calendar.ZoneInfo to allowList in SafeObjectInputStream configuration (cherry picked from commit 1a012021eacc1adb8618ec2c809f758c1ac1ab74) --- framework/base/config/SafeObjectInputStream.properties | 2 +- .../main/java/org/apache/ofbiz/base/util/SafeObjectInputStream.java | 3 ++- 2 files changed, 3 insertions(+), 2 deletions(-) diff --git a/framework/base/config/SafeObjectInputStream.properties b/framework/base/config/SafeObjectInputStream.properties index 3e6fda2e74..7f759b66f5 100644 --- a/framework/base/config/SafeObjectInputStream.properties +++ b/framework/base/config/SafeObjectInputStream.properties @@ -27,7 +27,7 @@ # . don't forget to add new objects in SafeObjectInputStream class too (as default there). # . "foo" and "SerializationInjector" are used in OFBiz tests -allowList=byte\\[\\], foo, SerializationInjector, \\[Z,\\[B,\\[S,\\[I,\\[J,\\[F,\\[D,\\[C, java..*, org.apache.ofbiz..*, org.codehaus.groovy.runtime.GStringImpl, groovy.lang.GString +allowList=byte\\[\\], foo, SerializationInjector, \\[Z,\\[B,\\[S,\\[I,\\[J,\\[F,\\[D,\\[C, java..*, org.apache.ofbiz..*, org.codehaus.groovy.runtime.GStringImpl, groovy.lang.GString, sun.util.calendar.ZoneInfo #-- List of strings rejected for serialisation #-- The same comments than for allowList apply to denyList diff --git a/framework/base/src/main/java/org/apache/ofbiz/base/util/SafeObjectInputStream.java b/framework/base/src/main/java/org/apache/ofbiz/base/util/SafeObjectInputStream.java index aedea1a082..9fe35b58f9 100644 --- a/framework/base/src/main/java/org/apache/ofbiz/base/util/SafeObjectInputStream.java +++ b/framework/base/src/main/java/org/apache/ofbiz/base/util/SafeObjectInputStream.java @@ -68,7 +68,8 @@ public final class SafeObjectInputStream extends ObjectInputStream { "org\\.apache\\.ofbiz\\.entity\\.GenericValue", "org\\.apache\\.ofbiz\\.entity\\.GenericPK", "org\\.codehaus\\.groovy\\.runtime\\.GStringImpl", - "groovy\\.lang\\.GString"}; + "groovy\\.lang\\.GString", + "sun\\.util\\.calendar\\.ZoneInfo"}; private static final String[] DEFAULT_DENYLIST = {"rmi", "<"}; /** The regular expression used to match serialized types. */
