Uploaded image for project: 'Commons IO'
  1. Commons IO
  2. IO-487

ValidatingObjectInputStream contribution - restrict which classes can be deserialized

    XMLWordPrintableJSON

Details

    • Improvement
    • Status: Closed
    • Minor
    • Resolution: Fixed
    • 2.4
    • 2.5
    • Utilities
    • Patch

    Description

      As discussed on the commons dev list I'd like to contribute my SLING-5288 code to commons-io. I'll attach a patch.

      Update: this is committed now, see [1] for an example.

      [1] https://svn.apache.org/repos/asf/commons/proper/io/trunk/src/test/java/org/apache/commons/io/serialization/MoreComplexObjectTest.java

      Attachments

        1. IO-487-name-regex-acceptor.patch
          12 kB
          Niall Pemberton
        2. IO-487-matchers.patch
          23 kB
          Bertrand Delacretaz
        3. IO-487-accept-reject-2.patch
          31 kB
          Bertrand Delacretaz
        4. IO-487-accept-reject.patch
          30 kB
          Bertrand Delacretaz
        5. IO-487-2.patch
          24 kB
          Niall Pemberton
        6. IO-487.patch
          18 kB
          Bertrand Delacretaz
        7. IO-487.patch
          18 kB
          Bertrand Delacretaz
        8. IO-487.patch
          18 kB
          Bertrand Delacretaz
        9. IO-487.patch
          44 kB
          Adrian Crum
        10. IO-487.patch
          46 kB
          Adrian Crum
        11. IO-487.patch
          23 kB
          Adrian Crum
        12. IO-487.patch
          51 kB
          Adrian Crum

        Issue Links

          is related to

          Bug - A problem which impairs or prevents the functions of the product. SLING-5288 Restrict which classes can be deserialized

          • Major - Major loss of function.
          • Resolved

          Bug - A problem which impairs or prevents the functions of the product. COLLECTIONS-580 Arbitrary remote code execution with InvokerTransformer

          • Major - Major loss of function.
          • Closed
          relates to

          Task - A task that needs to be done. SLING-5685 Upgrade Commons IO to 2.5

          • Major - Major loss of function.
          • Closed

          Activity

            People

              Unassigned Unassigned
              bdelacretaz Bertrand Delacretaz
              Votes:
              0 Vote for this issue
              Watchers:
              12 Start watching this issue

              Dates

                Created:
                Updated:
                Resolved: