ZhouXY108/hutool
1
0
Fork 0
mirror of https://gitee.com/chinabugotech/hutool.git synced 2025-05-09 23:51:34 +08:00
Code Issues Packages Projects Releases Wiki Activity

SerializeUtil.deserialize增加白名单类，避免RCE vulnerability

Browse Source
This commit is contained in:
Looly 2023-03-28 19:09:59 +08:00
parent 636f238dbe
commit 73cf56f3a2
3 changed files with 16 additions and 5 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
CHANGELOG.md
View File

@ -2,9 +2,10 @@
# 🚀Changelog # 🚀Changelog
------------------------------------------------------------------------------------------------------------- -------------------------------------------------------------------------------------------------------------
# 5.8.17.M1 (2023-03-26) # 5.8.17.M1 (2023-03-28)
### 🐣新特性 ### 🐣新特性
* 【core 】 SerializeUtil.deserialize增加白名单类，避免RCE vulnerability（issue#3021@Github）
### 🐞Bug修复 ### 🐞Bug修复

5
hutool-core/src/main/java/cn/hutool/core/util/ObjectUtil.java
View File

@ -588,10 +588,11 @@ public class ObjectUtil {
* *
* @param <T> 对象类型 * @param <T> 对象类型
* @param bytes 反序列化的字节码 * @param bytes 反序列化的字节码
* @param acceptClasses 白名单的类
* @return 反序列化后的对象 * @return 反序列化后的对象
*/ */
public static <T> T deserialize(byte[] bytes) { public static <T> T deserialize(byte[] bytes, Class<?>... acceptClasses) {
return SerializeUtil.deserialize(bytes); return SerializeUtil.deserialize(bytes, acceptClasses);
} }
/** /**

13
hutool-core/src/main/java/cn/hutool/core/util/SerializeUtil.java
View File

@ -2,9 +2,12 @@ package cn.hutool.core.util;
import cn.hutool.core.exceptions.UtilException; import cn.hutool.core.exceptions.UtilException;
import cn.hutool.core.io.FastByteArrayOutputStream; import cn.hutool.core.io.FastByteArrayOutputStream;
import cn.hutool.core.io.IORuntimeException;
import cn.hutool.core.io.IoUtil; import cn.hutool.core.io.IoUtil;
import cn.hutool.core.io.ValidateObjectInputStream;
import java.io.ByteArrayInputStream; import java.io.ByteArrayInputStream;
import java.io.IOException;
import java.io.Serializable; import java.io.Serializable;
/** /**
@ -59,9 +62,15 @@ public class SerializeUtil {
* *
* @param <T> 对象类型 * @param <T> 对象类型
* @param bytes 反序列化的字节码 * @param bytes 反序列化的字节码
* @param acceptClasses 白名单的类
* @return 反序列化后的对象 * @return 反序列化后的对象
*/ */
public static <T> T deserialize(byte[] bytes) { public static <T> T deserialize(byte[] bytes, Class<?>... acceptClasses) {
return IoUtil.readObj(new ByteArrayInputStream(bytes)); try {
return IoUtil.readObj(new ValidateObjectInputStream(
new ByteArrayInputStream(bytes), acceptClasses));
} catch (IOException e) {
throw new IORuntimeException(e);
}
} }
} }