Logback Core Module 1.5.1 · ch.qos.logback.core.net.HardenedObjectInputStream

public Class HardenedObjectInputStream

HardenedObjectInputStream restricts the set of classes that can be deserialized to a set of explicitly whitelisted classes. This prevents certain type of attacks from being successful.

It is assumed that classes in the "java.lang" and "java.util" packages are always authorized.

Author

Ceki Gülcü

Since

1.2.0

Field Summary

Modifier and Type	Field and Description
private static final int	ARRAY_LIMIT
private static final int	DEPTH_LIMIT
private static final String[]	JAVA_PACKAGES
private final List<String>	whitelistedClassNames

Access	Constructor and Description
public	HardenedObjectInputStream(InputStream in, String[] whitelist)
public	HardenedObjectInputStream(InputStream in, List<String> whitelist)

Access

Constructor and Description

public

HardenedObjectInputStream(InputStream in, String[] whitelist)

public

HardenedObjectInputStream(InputStream in, List<String> whitelist)

Modifier and Type	Method and Description
protected void	addToWhitelist(List<String> additionalAuthorizedClasses)
private void	initObjectFilter()
private boolean	isWhitelisted(String incomingClassName)
protected Class<?>	resolveClass(ObjectStreamClass an instance of class `ObjectStreamClass` anObjectStreamClass) Overrides java.io.ObjectInputStream.resolveClass. Load the local class equivalent of the specified stream class description.

Modifier and Type

Method and Description

protected void

addToWhitelist(List<String> additionalAuthorizedClasses)

private void

initObjectFilter()

private boolean

isWhitelisted(String incomingClassName)

protected Class<?>

resolveClass(ObjectStreamClass

an instance of class ObjectStreamClass

anObjectStreamClass)

Overrides java.io.ObjectInputStream.resolveClass.

Load the local class equivalent of the specified stream class description.

Field Detail

ARRAY_LIMIT	back to summary
private static final int ARRAY_LIMIT

DEPTH_LIMIT	back to summary
private static final int DEPTH_LIMIT

JAVA_PACKAGES	back to summary
private static final String[] JAVA_PACKAGES

whitelistedClassNames	back to summary
private final List<String> whitelistedClassNames

Constructor Detail

HardenedObjectInputStream	back to summary
public HardenedObjectInputStream(InputStream in, String[] whitelist) throws IOException

HardenedObjectInputStream	back to summary
public HardenedObjectInputStream(InputStream in, List<String> whitelist) throws IOException

Method Detail

addToWhitelist	back to summary
protected void addToWhitelist(List<String> additionalAuthorizedClasses)

initObjectFilter	back to summary
private void initObjectFilter()

isWhitelisted	back to summary
private boolean isWhitelisted(String incomingClassName)

resolveClass back to summary

resolveClass	back to summary
protected Class<?> resolveClass(ObjectStreamClass anObjectStreamClass) throws IOException, ClassNotFoundException Overrides java.io.ObjectInputStream.resolveClass. Doc from java.io.ObjectInputStream.resolveClass. Load the local class equivalent of the specified stream class description. Subclasses may implement this method to allow classes to be fetched from an alternate source. The corresponding method in `ObjectOutputStream` is `annotateClass`. This method will be invoked only once for each unique class in the stream. This method can be implemented by subclasses to use an alternate loading mechanism but must return a `Class` object. Once returned, if the class is not an array class, its serialVersionUID is compared to the serialVersionUID of the serialized class, and if there is a mismatch, the deserialization fails and an `InvalidClassException` is thrown. The default implementation of this method in `ObjectInputStream` returns the result of calling `Class.forName(desc.getName(), false, loader)` Class.forName(desc.getName(), false, loader) where `loader` is the first class loader on the current thread's stack (starting from the currently executing method) that is neither the platform class loader nor its ancestor; otherwise, `loader` is the platform class loader. If this call results in a `ClassNotFoundException` and the name of the passed `ObjectStreamClass` instance is the Java language keyword for a primitive type or void, then the `Class` object representing that primitive type or void will be returned (e.g., an `ObjectStreamClass` with the name `"int"` will be resolved to `Integer.TYPE`). Otherwise, the `ClassNotFoundException` will be thrown to the caller of this method. Parameters anObjectStreamClass:ObjectStreamClass an instance of class `ObjectStreamClass` Returns:Class<?> a `Class` object corresponding to `desc` Annotations @Override Exceptions IOException: any of the usual Input/Output exceptions. ClassNotFoundException: if class of a serialized object cannot be found.

protected Class<?> resolveClass(ObjectStreamClass anObjectStreamClass) throws IOException, ClassNotFoundException

Overrides java.io.ObjectInputStream.resolveClass.

Doc from java.io.ObjectInputStream.resolveClass.

Load the local class equivalent of the specified stream class description. Subclasses may implement this method to allow classes to be fetched from an alternate source.

The corresponding method in ObjectOutputStream is annotateClass. This method will be invoked only once for each unique class in the stream. This method can be implemented by subclasses to use an alternate loading mechanism but must return a Class object. Once returned, if the class is not an array class, its serialVersionUID is compared to the serialVersionUID of the serialized class, and if there is a mismatch, the deserialization fails and an InvalidClassException is thrown.

The default implementation of this method in ObjectInputStream returns the result of calling

Class.forName(desc.getName(), false, loader)

where loader is the first class loader on the current thread's stack (starting from the currently executing method) that is neither the platform class loader nor its ancestor; otherwise, loader is the platform class loader. If this call results in a ClassNotFoundException and the name of the passed ObjectStreamClass instance is the Java language keyword for a primitive type or void, then the Class object representing that primitive type or void will be returned (e.g., an ObjectStreamClass with the name "int" will be resolved to Integer.TYPE). Otherwise, the ClassNotFoundException will be thrown to the caller of this method.

Parameters

anObjectStreamClass:ObjectStreamClass: an instance of class ObjectStreamClass

Returns:Class<?>

a Class object corresponding to desc

Annotations

@Override

Exceptions

IOException:: any of the usual Input/Output exceptions.
ClassNotFoundException:: if class of a serialized object cannot be found.

public Class HardenedObjectInputStream

Field Summary

Constructor Summary

Method Summary

Field Detail

Constructor Detail

Method Detail