@Test void whitelist() throws Exception { final byte[] serializationHeader = new byte[] { (byte) (((short) 0xaced >>> 8) & 0xFF), (byte) (((short) 0xaced) & 0xFF), (byte) (((short) 5 >>> 8) & 0xFF), (byte) (((short) 5) & 0xFF) }; final ObjectStreamClass desc = ObjectStreamClass.lookup(Ser.class); assertNotNull(new EnhancedObjectInputStream(new ByteArrayInputStream(serializationHeader), Thread.currentThread().getContextClassLoader(), name -> name .equals("org.talend.sdk.component.runtime.serialization.EnhancedObjectInputStreamTest$Ser")) { }.resolveClass(desc)); assertThrows(SecurityException.class, () -> new EnhancedObjectInputStream( new ByteArrayInputStream(serializationHeader), Thread.currentThread().getContextClassLoader(), name -> name.equals("org.talend.sdk.component.runtime.serialization.EnhancedObjectInputStream")) { }.resolveClass(desc)); }
@Override protected Class<?> resolveClass(final ObjectStreamClass desc) throws ClassNotFoundException { final String name = desc.getName(); if (name.equals("boolean")) { return boolean.class; } if (name.equals("byte")) { return byte.class; } if (name.equals("char")) { return char.class; } if (name.equals("short")) { return short.class; } if (name.equals("int")) { return int.class; } if (name.equals("long")) { return long.class; } if (name.equals("float")) { return float.class; } if (name.equals("double")) { return double.class; } doSecurityCheck(name); try { return Class.forName(name, false, loader); } catch (final ClassNotFoundException e) { return Class.forName(name, false, getClass().getClassLoader()); } }
EnhancedObjectInputStream extends ObjectInputStream { @Override protected Class<?> resolveClass(final ObjectStreamClass desc) throws ClassNotFoundException { final String name = desc.getName(); if (name.equals("boolean")) { return boolean.class; } if (name.equals("byte")) { return byte.class; } if (name.equals("char")) { return char.class; } if (name.equals("short")) { return short.class; } if (name.equals("int")) { return int.class; } if (name.equals("long")) { return long.class; } if (name.equals("float")) { return float.class; } if (name.equals("double")) { return double.class; } doSecurityCheck(name); try { return Class.forName(name, false, loader); } catch (final ClassNotFoundException e) { return Class.forName(name, false, getClass().getClassLoader()); } } }
EnhancedObjectInputStream extends ObjectInputStream { @Override protected Class<?> resolveClass(final ObjectStreamClass desc) throws ClassNotFoundException { final String name = desc.getName(); if (name.equals("boolean")) { return boolean.class; } if (name.equals("byte")) { return byte.class; } if (name.equals("char")) { return char.class; } if (name.equals("short")) { return short.class; } if (name.equals("int")) { return int.class; } if (name.equals("long")) { return long.class; } if (name.equals("float")) { return float.class; } if (name.equals("double")) { return double.class; } doSecurityCheck(name); try { return Class.forName(name, false, loader); } catch (final ClassNotFoundException e) { return Class.forName(name, false, getClass().getClassLoader()); } } protected  EnhancedObjectInputStream(final InputStream in, final ClassLoader loader, final Predicate<String> filter);  EnhancedObjectInputStream(final InputStream in, final ClassLoader loader); }
EnhancedObjectInputStream extends ObjectInputStream { @Override protected Class<?> resolveClass(final ObjectStreamClass desc) throws ClassNotFoundException { final String name = desc.getName(); if (name.equals("boolean")) { return boolean.class; } if (name.equals("byte")) { return byte.class; } if (name.equals("char")) { return char.class; } if (name.equals("short")) { return short.class; } if (name.equals("int")) { return int.class; } if (name.equals("long")) { return long.class; } if (name.equals("float")) { return float.class; } if (name.equals("double")) { return double.class; } doSecurityCheck(name); try { return Class.forName(name, false, loader); } catch (final ClassNotFoundException e) { return Class.forName(name, false, getClass().getClassLoader()); } } protected  EnhancedObjectInputStream(final InputStream in, final ClassLoader loader, final Predicate<String> filter);  EnhancedObjectInputStream(final InputStream in, final ClassLoader loader);  }
EnhancedObjectInputStream extends ObjectInputStream { @Override protected Class<?> resolveClass(final ObjectStreamClass desc) throws ClassNotFoundException { final String name = desc.getName(); if (name.equals("boolean")) { return boolean.class; } if (name.equals("byte")) { return byte.class; } if (name.equals("char")) { return char.class; } if (name.equals("short")) { return short.class; } if (name.equals("int")) { return int.class; } if (name.equals("long")) { return long.class; } if (name.equals("float")) { return float.class; } if (name.equals("double")) { return double.class; } doSecurityCheck(name); try { return Class.forName(name, false, loader); } catch (final ClassNotFoundException e) { return Class.forName(name, false, getClass().getClassLoader()); } } protected  EnhancedObjectInputStream(final InputStream in, final ClassLoader loader, final Predicate<String> filter);  EnhancedObjectInputStream(final InputStream in, final ClassLoader loader);   }