[
https://issues.apache.org/jira/browse/IO-487?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel=15018083#comment-15018083
]
Bertrand Delacretaz commented on IO-487:
To match against Class objects you'd need to instantiate
[
https://issues.apache.org/jira/browse/IO-487?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel=15018084#comment-15018084
]
Bertrand Delacretaz commented on IO-487:
Regarding the various usability suggestions I think those are
[
https://issues.apache.org/jira/browse/IO-487?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel=15014017#comment-15014017
]
Bertrand Delacretaz commented on IO-487:
Ran the Cobertura coverage with "mvn site",
[
https://issues.apache.org/jira/browse/IO-487?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel
]
Bertrand Delacretaz updated IO-487:
---
Description:
As discussed on the commons dev list I'd like to contribute my SLING-5288 code
to
[
https://issues.apache.org/jira/browse/IO-487?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel=15014417#comment-15014417
]
Bertrand Delacretaz commented on IO-487:
bq. If you have to declare any accepted class, you might be
[
https://issues.apache.org/jira/browse/IO-487?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel=15014154#comment-15014154
]
Bertrand Delacretaz commented on IO-487:
Done, http://svn.apache.org/r1715240
>
[
https://issues.apache.org/jira/browse/IO-487?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel=15013920#comment-15013920
]
Bertrand Delacretaz commented on IO-487:
I have committed IO-487-accept-reject-2.patch with minor
[
https://issues.apache.org/jira/browse/IO-487?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel=15013920#comment-15013920
]
Bertrand Delacretaz edited comment on IO-487 at 11/19/15 5:11 PM:
--
I have
[
https://issues.apache.org/jira/browse/IO-487?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel=15013951#comment-15013951
]
Bertrand Delacretaz commented on IO-487:
bq. If I try to exploit code by desrializing MyExploit.class,
[
https://issues.apache.org/jira/browse/IO-487?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel=15013966#comment-15013966
]
Bertrand Delacretaz commented on IO-487:
Added the class name in the InvalidClassException, as
[
https://issues.apache.org/jira/browse/IO-487?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel
]
Bertrand Delacretaz updated IO-487:
---
Summary: ValidatingObjectInputStream contribution - restrict which classes
can be deserialized
[
https://issues.apache.org/jira/browse/IO-487?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel
]
Bertrand Delacretaz updated IO-487:
---
Attachment: IO-487-accept-reject-2.patch
Here's an updated {{IO-487-accept-reject-2.patch}} that
[
https://issues.apache.org/jira/browse/IO-487?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel=15011332#comment-15011332
]
Bertrand Delacretaz commented on IO-487:
bq. if nobody objects you can even do it yourself since the
[
https://issues.apache.org/jira/browse/IO-487?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel=15011611#comment-15011611
]
Bertrand Delacretaz commented on IO-487:
RestrictedObjectInputStream maybe, but
[
https://issues.apache.org/jira/browse/IO-487?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel=15011647#comment-15011647
]
Bertrand Delacretaz commented on IO-487:
at least you spelled it right, that's no so common ;-)
>
[
https://issues.apache.org/jira/browse/IO-487?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel=15006893#comment-15006893
]
Bertrand Delacretaz commented on IO-487:
The {{IO-487-accept-reject.patch}} uses a different and much
[
https://issues.apache.org/jira/browse/IO-487?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel=15006769#comment-15006769
]
Bertrand Delacretaz commented on IO-487:
You mean in methods like {{accept(MyClass.class)}} ?
One
[
https://issues.apache.org/jira/browse/IO-487?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel=15006769#comment-15006769
]
Bertrand Delacretaz edited comment on IO-487 at 11/16/15 3:22 PM:
--
You mean
[
https://issues.apache.org/jira/browse/IO-487?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel=15006594#comment-15006594
]
Bertrand Delacretaz commented on IO-487:
bq. I'd suggest adding the name of the class rejected to the
[
https://issues.apache.org/jira/browse/IO-487?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel=15006676#comment-15006676
]
Bertrand Delacretaz commented on IO-487:
bq. ...any class is rejected unless it's explicitly accepted.
[
https://issues.apache.org/jira/browse/IO-487?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel=15007292#comment-15007292
]
Bertrand Delacretaz commented on IO-487:
For that you can write a ClassNameMatcher that accepts
[
https://issues.apache.org/jira/browse/IO-487?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel
]
Bertrand Delacretaz updated IO-487:
---
Attachment: IO-487-accept-reject.patch
Here's IO-487-accept-reject.patch with the suggested
[
https://issues.apache.org/jira/browse/IO-487?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel=15006559#comment-15006559
]
Bertrand Delacretaz edited comment on IO-487 at 11/16/15 11:51 AM:
---
Here's
[
https://issues.apache.org/jira/browse/IO-487?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel
]
Bertrand Delacretaz updated IO-487:
---
Attachment: IO-487-matchers.patch
Based on all those great ideas, here's a variant
[
https://issues.apache.org/jira/browse/IO-487?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel=15006477#comment-15006477
]
Bertrand Delacretaz edited comment on IO-487 at 11/16/15 10:37 AM:
---
Or maybe
[
https://issues.apache.org/jira/browse/IO-487?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel=15006477#comment-15006477
]
Bertrand Delacretaz commented on IO-487:
Or maybe
{code}
ObjectInputStream ois =
new
[
https://issues.apache.org/jira/browse/IO-487?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel=15006512#comment-15006512
]
Bertrand Delacretaz commented on IO-487:
bq. ...we can reuse FilenameUtils.wildcardMatch(String,
[
https://issues.apache.org/jira/browse/IO-487?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel=15004397#comment-15004397
]
Bertrand Delacretaz commented on IO-487:
Forgot to mention good contributions from
Bertrand Delacretaz created IO-487:
--
Summary: SafeObjectInputStream contribution - restrict which
classes can be deserialized
Key: IO-487
URL: https://issues.apache.org/jira/browse/IO-487
Project:
[
https://issues.apache.org/jira/browse/IO-487?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel
]
Bertrand Delacretaz updated IO-487:
---
Attachment: IO-487.patch
> SafeObjectInputStream contribution - restrict which classes can be
>
[
https://issues.apache.org/jira/browse/IO-487?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel
]
Bertrand Delacretaz updated IO-487:
---
Attachment: IO-487.patch
Here's an updated patch that uses UnsupportedOperationException, good
[
https://issues.apache.org/jira/browse/IO-487?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel=15004563#comment-15004563
]
Bertrand Delacretaz commented on IO-487:
You are welcome!
> SafeObjectInputStream contribution -
[
https://issues.apache.org/jira/browse/IO-487?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel
]
Bertrand Delacretaz updated IO-487:
---
Attachment: IO-487.patch
Another update...just a comment change.
> SafeObjectInputStream
[
https://issues.apache.org/jira/browse/IO-487?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel=15004870#comment-15004870
]
Bertrand Delacretaz commented on IO-487:
RestrictedObjectInputStream?
> SafeObjectInputStream
[
https://issues.apache.org/jira/browse/IO-487?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel=15004869#comment-15004869
]
Bertrand Delacretaz commented on IO-487:
RestrictedObjectInputStream?
> SafeObjectInputStream
35 matches
Mail list logo
