...
This rule complements rule SER12-J. Prevent deserialization of untrusted classesdata. Whereas SER12-J requires the programmer to ensure the absence of classes that might perform dangerous operations by validating data before deserializing it, SER13-J requires that all serializable classes refrain, by default, from performing dangerous operations during deserialization. SER12-J and SER13-J both guard against the same class of deserialization vulnerabilities. Theoretically, a given system is secure against this class of vulnerabilities if either (1) all deployed code on that system follows SER12-J or (2) all deployed code on that system follows SER13-J. However, because much existing code violates both of these rules, the CERT Coding Standard takes the "belt and suspenders" approach and requires compliant code to follow both rules.
...
| Code Block | ||||
|---|---|---|---|---|
| ||||
import java.io.*;
class OpenedFile implements Serializable {
String filename;
BufferedReader reader;
public OpenedFile(String _filename) throws FileNotFoundException {
this.filename = _filename;
init();
}
private void init() throws FileNotFoundException {
reader = new BufferedReader(new FileReader(filename));
}
private void writeObject(ObjectOutputStream out) throws IOException {
out.writeUTF(filename);
}
private void readObject(ObjectInputStream in) throws IOException, ClassNotFoundException {
filename = in.readUTF();
init();
}
} |
...
| Code Block | ||||
|---|---|---|---|---|
| ||||
import java.io.*;
import java.lang.reflect.*;
class OpenedFile implements Serializable {
String filename;
BufferedReader reader;
public OpenedFile(String _filename) throws FileNotFoundException {
this.filename = _filename;
init();
}
private void init() throws FileNotFoundException {
reader = new BufferedReader(new FileReader(filename));
}
private void writeObject(ObjectOutputStream out) throws IOException {
out.writeUTF(filename);
}
private void readObject(ObjectInputStream in) throws IOException, ClassNotFoundException {
boolean hasWhitelist = false;
try {
in.getClass().getDeclaredField("whitelist");
hasWhitelist = true;
} catch (ReflectiveOperationException e) {}
if (!hasWhitelist) {
throw new SecurityException("Deserialization without a whitelist is disallowed for class " +
this.getClass().getName() + ".");
}
filename = in.readUTF();
init();
}
} |
...
| Code Block | ||||
|---|---|---|---|---|
| ||||
import java.io.*;
class OpenedFile implements Serializable {
String filename;
BufferedReader reader;
boolean isInitialized;
public OpenedFile(String _filename) {
this.filename = _filename;
isInitialized = false;
}
public void init() throws FileNotFoundException {
reader = new BufferedReader(new FileReader(filename));
isInitialized = true;
}
private void writeObject(ObjectOutputStream out) throws IOException {
out.writeUTF(filename);
}
private void readObject(ObjectInputStream in) throws IOException, ClassNotFoundException {
filename = in.readUTF();
isInitialized = false;
}
} |
...