This is an automated email from the ASF dual-hosted git repository.
mridulpathak pushed a commit to branch trunk
in repository https://gitbox.apache.org/repos/asf/ofbiz-framework.git
The following commit(s) were added to refs/heads/trunk by this push:
new 5beebac638 Improved: SafeObjectInputStream allowList matches class
names as substrings and ships with unescaped dots (OFBIZ-13637)
5beebac638 is described below
commit 5beebac638868c4c676776f692c6191674de11f0
Author: Mridul Pathak <[email protected]>
AuthorDate: Sat Oct 3 19:17:50 2026 +0530
Improved: SafeObjectInputStream allowList matches class names as substrings
and ships with unescaped dots (OFBIZ-13637)
SafeObjectInputStream decided whether a class could be deserialized with
Matcher.find(), which accepts a class name that merely contains an allowed
fragment. The allowList shipped in SafeObjectInputStream.properties also used
unescaped dots and kept the test-only entries "foo" and
"SerializationInjector", so in practice any class whose name contained "java"
followed by a character (for example javax.* or javassist.*) or the text "foo"
was accepted, instead of only java.* and org.apach [...]
- SafeObjectInputStream now requires the whole class name to match an
allowList entry (Matcher.matches()). Object-array class names such as
[Ljava.lang.String; are matched on their element type so arrays of allowed
classes keep working.
- The shipped allowList escapes its dots, and no longer contains the
entries that were only used by tests, which set their own allowList.
---
.../base/config/SafeObjectInputStream.properties | 4 ++--
.../apache/ofbiz/base/util/SafeObjectInputStream.java | 19 ++++++++++++++++++-
2 files changed, 20 insertions(+), 3 deletions(-)
diff --git a/framework/base/config/SafeObjectInputStream.properties
b/framework/base/config/SafeObjectInputStream.properties
index 7b875ef13f..21c1940970 100644
--- a/framework/base/config/SafeObjectInputStream.properties
+++ b/framework/base/config/SafeObjectInputStream.properties
@@ -23,11 +23,11 @@
# As an example, the a complete list of objects used by OFBiz OOTB is here in
allowList.
# You will need to add your objects/classes to this list.
+# Each entry is a regular expression that must match the whole class name
(escape the dots).
# OFBiz committers:
# . don't forget to add new objects in SafeObjectInputStream class too (as
default there).
-# . "foo" and "SerializationInjector" are used in OFBiz tests
-allowList=byte\\[\\], foo, SerializationInjector,
\\[Z,\\[B,\\[S,\\[I,\\[J,\\[F,\\[D,\\[C, java..*, org.apache.ofbiz..*,
org.codehaus.groovy.runtime.GStringImpl, groovy.lang.GString,
sun.util.calendar.ZoneInfo
+allowList=byte\\[\\], \\[Z,\\[B,\\[S,\\[I,\\[J,\\[F,\\[D,\\[C, java\\..*,
org\\.apache\\.ofbiz\\..*, org\\.codehaus\\.groovy\\.runtime\\.GStringImpl,
groovy\\.lang\\.GString, sun\\.util\\.calendar\\.ZoneInfo
#-- List of strings rejected for serialisation
#-- The same comments than for allowList apply to denyList
diff --git
a/framework/base/src/main/java/org/apache/ofbiz/base/util/SafeObjectInputStream.java
b/framework/base/src/main/java/org/apache/ofbiz/base/util/SafeObjectInputStream.java
index ee40f757df..256d7dc5d2 100644
---
a/framework/base/src/main/java/org/apache/ofbiz/base/util/SafeObjectInputStream.java
+++
b/framework/base/src/main/java/org/apache/ofbiz/base/util/SafeObjectInputStream.java
@@ -90,6 +90,23 @@ public final class SafeObjectInputStream extends
ObjectInputStream {
.collect(collectingAndThen(joining("|", "(", ")"),
Pattern::compile));
}
+ /**
+ * Returns the name to check against the allowlist: for an array of
objects (e.g. {@code [Ljava.lang.String;}) the
+ * name of its element type, for any other class its own name.
+ * @param className the class name as found in the serialization stream
+ * @return the name to match against the allowlist
+ */
+ private static String componentTypeName(String className) {
+ int dims = 0;
+ while (dims < className.length() && className.charAt(dims) == '[') {
+ dims++;
+ }
+ if (dims > 0 && className.length() > dims + 2 &&
className.charAt(dims) == 'L' && className.endsWith(";")) {
+ return className.substring(dims + 1, className.length() - 1);
+ }
+ return className;
+ }
+
@Override
protected Class<?> resolveClass(ObjectStreamClass classDesc) throws
IOException, ClassNotFoundException {
String className = classDesc.getName();
@@ -102,7 +119,7 @@ public final class SafeObjectInputStream extends
ObjectInputStream {
throw new InvalidClassException(className, "Unauthorized
deserialisation attempt");
}
}
- if (!allowlistPattern.matcher(className).find()) {
+ if (!allowlistPattern.matcher(componentTypeName(className)).matches())
{
Debug.logWarning("***Incompatible class***: " + className
+ ". Please see OFBIZ-10837. Report to dev ML if you use
OFBiz without changes. "
+ "Else follow https://s.apache.org/45war";,
