lprimak commented on code in PR #2832:
URL: https://github.com/apache/shiro/pull/2832#discussion_r3575665358
##########
lang/src/main/java/org/apache/shiro/lang/io/DefaultSerializer.java:
##########
@@ -94,4 +110,38 @@ public T deserialize(byte[] serialized) throws
SerializationException {
protected ObjectInputStream createObjectInputStream(InputStream
inputStream) throws IOException {
return new ClassResolvingObjectInputStream(inputStream);
}
+
+ /**
+ * Returns the <a href="https://openjdk.org/jeps/290";>JEP-290</a> {@link
ObjectInputFilter} applied to the
+ * {@link ObjectInputStream} used by {@link #deserialize(byte[])}, or
{@code null} if none is configured.
+ *
+ * @return the configured {@code ObjectInputFilter}, or {@code null} if
none is configured.
+ * @since 3.1
+ */
+ public ObjectInputFilter getObjectInputFilter() {
Review Comment:
This should be pulled up
##########
lang/src/main/java/org/apache/shiro/lang/io/DefaultSerializer.java:
##########
@@ -94,4 +110,38 @@ public T deserialize(byte[] serialized) throws
SerializationException {
protected ObjectInputStream createObjectInputStream(InputStream
inputStream) throws IOException {
return new ClassResolvingObjectInputStream(inputStream);
}
+
+ /**
+ * Returns the <a href="https://openjdk.org/jeps/290";>JEP-290</a> {@link
ObjectInputFilter} applied to the
+ * {@link ObjectInputStream} used by {@link #deserialize(byte[])}, or
{@code null} if none is configured.
+ *
+ * @return the configured {@code ObjectInputFilter}, or {@code null} if
none is configured.
+ * @since 3.1
+ */
+ public ObjectInputFilter getObjectInputFilter() {
+ return objectInputFilter;
+ }
+
+ /**
+ * Sets a <a href="https://openjdk.org/jeps/290";>JEP-290</a> {@link
ObjectInputFilter} to apply to the
+ * {@link ObjectInputStream} used by {@link #deserialize(byte[])},
providing defense-in-depth against
+ * malicious serialized payloads (for example, a class or resource-limit
allow-list) in addition to any
+ * validation the caller performs on the deserialized result.
+ * <p/>
+ * The filter is consulted by the JVM for every class resolved while
reading the stream, before that
+ * class is instantiated - a rejecting filter causes {@code deserialize}
to fail (wrapped in a
+ * {@link SerializationException}) instead of constructing the disallowed
object. See
+ * {@link ObjectInputFilter.Config#createFilter(String)} for a convenient
way to build a pattern-based
+ * filter combining class allow/deny lists with depth, reference, and
byte-count limits.
+ * <p/>
+ * The default is {@code null} (no filter), matching this class's behavior
prior to this option being
+ * introduced. Callers handling untrusted input, such as {@link
org.apache.shiro.mgt.AbstractRememberMeManager
+ * AbstractRememberMeManager}'s RememberMe cookie deserialization, are
encouraged to configure one.
+ *
+ * @param objectInputFilter the filter to apply, or {@code null} to
disable filtering (the default).
+ * @since 3.1
+ */
+ public void setObjectInputFilter(ObjectInputFilter objectInputFilter) {
Review Comment:
This should be pulled up
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
