Fixed: Adds a blacklist (to be renamed soon to denylist) in Java serialisation (OFBIZ-12167)

JacquesLeRoux · JacquesLeRoux · commit af9ed4e68e90 · 2021-02-05T11:02:28.000+01:00
Adds an example based on RMI which is known to be a problem
diff --git a/framework/base/src/main/java/org/apache/ofbiz/base/util/SafeObjectInputStream.java b/framework/base/src/main/java/org/apache/ofbiz/base/util/SafeObjectInputStream.java
@@ -62,9 +62,18 @@ public SafeObjectInputStream(InputStream in) throws IOException {
 
     @Override
     protected Class<?> resolveClass(ObjectStreamClass classDesc) throws IOException, ClassNotFoundException {
-        if (!whitelistPattern.matcher(classDesc.getName()).find()) {
+        String className = classDesc.getName();
+        // BlackList exploits; eg: don't allow RMI here
+        if (className.contains("java.rmi.server")) {
+            Debug.logWarning("***Incompatible class***: "
+                    + classDesc.getName()
+                    + ". java.rmi.server classes are not allowed for security reason",
+                    "SafeObjectInputStream");
+            return null;
+        }
+        if (!whitelistPattern.matcher(className).find()) {
             // DiskFileItem, FileItemHeadersImpl are not serializable.
-            if (classDesc.getName().contains("org.apache.commons.fileupload")) {
+            if (className.contains("org.apache.commons.fileupload")) {
                 return null;
             }
             Debug.logWarning("***Incompatible class***: "
