package org.apache.logging.log4j.util;
import java.io.IOException;
import java.io.InputStream;
import java.io.InvalidObjectException;
import java.io.ObjectInputStream;
import java.io.ObjectStreamClass;
import java.util.Arrays;
import java.util.Collection;
import java.util.HashSet;
import java.util.List;
public class FilteredObjectInputStream extends ObjectInputStream {
private static final List<String> REQUIRED_JAVA_CLASSES = Arrays.asList(
"java.math.BigDecimal",
"java.math.BigInteger",
"java.rmi.MarshalledObject",
"[B"
);
private static final List<String> REQUIRED_JAVA_PACKAGES = Arrays.asList(
"java.lang.",
"java.time",
"java.util.",
"org.apache.logging.log4j.",
"[Lorg.apache.logging.log4j."
);
private final Collection<String> allowedClasses;
public FilteredObjectInputStream() throws IOException, SecurityException {
super();
this.allowedClasses = new HashSet<>();
}
public FilteredObjectInputStream(final InputStream in) throws IOException {
super(in);
this.allowedClasses = new HashSet<>();
}
public FilteredObjectInputStream(final Collection<String> allowedClasses) throws IOException, SecurityException {
super();
this.allowedClasses = allowedClasses;
}
public FilteredObjectInputStream(final InputStream in, final Collection<String> allowedClasses) throws IOException {
super(in);
this.allowedClasses = allowedClasses;
}
public Collection<String> getAllowedClasses() {
return allowedClasses;
}
@Override
protected Class<?> resolveClass(final ObjectStreamClass desc) throws IOException, ClassNotFoundException {
final String name = desc.getName();
if (!(isAllowedByDefault(name) || allowedClasses.contains(name))) {
throw new InvalidObjectException("Class is not allowed for deserialization: " + name);
}
return super.resolveClass(desc);
}
private static boolean isAllowedByDefault(final String name) {
return isRequiredPackage(name) || REQUIRED_JAVA_CLASSES.contains(name);
}
private static boolean isRequiredPackage(final String name) {
for (final String packageName : REQUIRED_JAVA_PACKAGES) {
if (name.startsWith(packageName)) {
return true;
}
}
return false;
}
}