...
| Code Block |
|---|
| bgColor | #FFcccc |
|---|
| language | java |
|---|
|
import java.io.*;
class OpenedFile implements Serializable {
public String filename;
public BufferedReader reader;
public OpenedFile(String _filename) throws FileNotFoundException {
filename = _filename;
init();
}
private void init() throws FileNotFoundException {
reader = new BufferedReader(new FileReader(filename));
}
private void writeObject(ObjectOutputStream out) throws IOException {
out.writeUTF(filename);
}
private void readObject(ObjectInputStream in) throws IOException, ClassNotFoundException {
filename = in.readUTF();
init();
}
} |
...
| Code Block |
|---|
| bgColor | #ccccff |
|---|
| language | java |
|---|
|
import java.io.*;
import java.lang.reflect.*;
class OpenedFile implements Serializable {
public String filename;
public BufferedReader reader;
public OpenedFile(String _filename) throws FileNotFoundException {
filename = _filename;
init();
}
private void init() throws FileNotFoundException {
reader = new BufferedReader(new FileReader(filename));
}
private void writeObject(ObjectOutputStream out) throws IOException {
out.writeUTF(filename);
}
private void readObject(ObjectInputStream in) throws IOException, ClassNotFoundException {
boolean hasWhitelist = false;
try {
Object whitelist = in.getClass().getDeclaredField("whitelist").get(in);
hasWhitelist = true;
} catch (ReflectiveOperationException e) {}
if (!hasWhitelist) {
throw new SecurityException("Deserialization without a whitelist is disallowed for class " +
this.getClass().getName() + ".");
}
filename = in.readUTF();
init();
}
} |
...
| Code Block |
|---|
| bgColor | #ccccff |
|---|
| language | java |
|---|
|
import java.io.*;
class OpenedFile implements Serializable {
public String filename;
public BufferedReader reader;
boolean isInitialized;
public OpenedFile(String _filename) throws FileNotFoundException {
filename = _filename;
isInitialized = false;
}
public void init() throws FileNotFoundException {
reader = new BufferedReader(new FileReader(filename));
isInitialized = true;
}
private void writeObject(ObjectOutputStream out) throws IOException {
out.writeUTF(filename);
}
private void readObject(ObjectInputStream in) throws IOException, ClassNotFoundException {
filename = in.readUTF();
isInitialized = false;
}
} |
Risk Assessment
The severity of violations of this rule depend on the nature of the potentially dangerous operations performed. If only mildly dangerous operations are performed, the risk might be limited to denial-of-service (DoS) attacks. At the other extreme, remote code execution is possible is attacker-supplied input is supplied to methods such as Runtime.exec (either directly or via reflection).
...
