CVE-2023-42809: Feature - allowedClasses setting added to SerializationCodec https://… · redisson/redisson@fe6a257

Expand Up

@@ -15,19 +15,19 @@

*/

package org.redisson.codec;

import java.io.IOException;

import java.io.ObjectInputStream;

import java.io.ObjectOutputStream;

import io.netty.buffer.ByteBuf;

import io.netty.buffer.ByteBufAllocator;

import io.netty.buffer.ByteBufInputStream;

import io.netty.buffer.ByteBufOutputStream;

import org.redisson.client.codec.BaseCodec;

import org.redisson.client.handler.State;

import org.redisson.client.protocol.Decoder;

import org.redisson.client.protocol.Encoder;

import io.netty.buffer.ByteBuf;

import io.netty.buffer.ByteBufAllocator;

import io.netty.buffer.ByteBufInputStream;

import io.netty.buffer.ByteBufOutputStream;

import java.io.IOException;

import java.io.ObjectInputStream;

import java.io.ObjectOutputStream;

import java.util.Set;

/**

* JDK’s serialization codec.

Expand All

@@ -51,7 +51,7 @@ public Object decode(ByteBuf buf, State state) throws IOException {

ObjectInputStream inputStream;

if (classLoader != null) {

Thread.currentThread().setContextClassLoader(classLoader);

inputStream = new CustomObjectInputStream(classLoader, in);

inputStream = new CustomObjectInputStream(classLoader, in, allowedClasses);

} else {

inputStream = new ObjectInputStream(in);

}

Expand Down Expand Up

@@ -84,7 +84,8 @@ public ByteBuf encode(Object in) throws IOException {

}

}

};

private Set<String> allowedClasses;

private final ClassLoader classLoader;

public SerializationCodec() {

Expand All

@@ -97,6 +98,12 @@ public SerializationCodec(ClassLoader classLoader) {

public SerializationCodec(ClassLoader classLoader, SerializationCodec codec) {

this.classLoader = classLoader;

this.allowedClasses = codec.allowedClasses;

}

public SerializationCodec(ClassLoader classLoader, Set<String> allowedClasses) {

this.classLoader = classLoader;

this.allowedClasses = allowedClasses;

}

@Override

Expand Down