From c89c542f7a1b59fde260581e6e80e4aa8a7b44c5 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Jindra=20Pet=C5=99=C3=ADk?= Date: Fri, 8 May 2026 13:58:33 +0200 Subject: [PATCH] fix: allow only safe classes on deserialization --- .../LegacyConfigurationStorage.java | 3 +- .../flash/search/ABCSearchResult.java | 3 +- .../flash/search/ActionSearchResult.java | 3 +- .../helpers/AllowedObjectInputStream.java | 82 +++++++++++++++++++ .../flash/gui/SearchResultsStorage.java | 6 +- 5 files changed, 92 insertions(+), 5 deletions(-) create mode 100644 libsrc/ffdec_lib/src/com/jpexs/helpers/AllowedObjectInputStream.java diff --git a/libsrc/ffdec_lib/src/com/jpexs/decompiler/flash/configuration/LegacyConfigurationStorage.java b/libsrc/ffdec_lib/src/com/jpexs/decompiler/flash/configuration/LegacyConfigurationStorage.java index 658413f86..4c0bfdff1 100644 --- a/libsrc/ffdec_lib/src/com/jpexs/decompiler/flash/configuration/LegacyConfigurationStorage.java +++ b/libsrc/ffdec_lib/src/com/jpexs/decompiler/flash/configuration/LegacyConfigurationStorage.java @@ -16,6 +16,7 @@ */ package com.jpexs.decompiler.flash.configuration; +import com.jpexs.helpers.AllowedObjectInputStream; import java.io.BufferedOutputStream; import java.io.FileInputStream; import java.io.FileOutputStream; @@ -42,7 +43,7 @@ public class LegacyConfigurationStorage implements ConfigurationStorage { @Override public Map loadFromFile(String file) { - try (ObjectInputStream ois = new ObjectInputStream(new FileInputStream(file))) { + try (ObjectInputStream ois = new AllowedObjectInputStream(new FileInputStream(file))) { @SuppressWarnings("unchecked") Map cfg = (HashMap) ois.readObject(); diff --git a/libsrc/ffdec_lib/src/com/jpexs/decompiler/flash/search/ABCSearchResult.java b/libsrc/ffdec_lib/src/com/jpexs/decompiler/flash/search/ABCSearchResult.java index 3433297d5..ce21ddd6f 100644 --- a/libsrc/ffdec_lib/src/com/jpexs/decompiler/flash/search/ABCSearchResult.java +++ b/libsrc/ffdec_lib/src/com/jpexs/decompiler/flash/search/ABCSearchResult.java @@ -24,6 +24,7 @@ import com.jpexs.decompiler.flash.abc.ScriptPack; import com.jpexs.decompiler.flash.helpers.GraphTextWriter; import com.jpexs.decompiler.flash.treeitems.Openable; import com.jpexs.decompiler.graph.DottedChain; +import com.jpexs.helpers.AllowedObjectInputStream; import java.io.IOException; import java.io.InputStream; import java.io.ObjectInputStream; @@ -96,7 +97,7 @@ public class ABCSearchResult implements Serializable, ScriptSearchResult { */ @SuppressWarnings("unchecked") public ABCSearchResult(Openable openable, InputStream is) throws IOException, ScriptNotFoundException { - ObjectInputStream ois = new ObjectInputStream(is); + ObjectInputStream ois = new AllowedObjectInputStream(is); int versionMajor = ois.read(); ois.read(); //minor if (versionMajor == 1) { diff --git a/libsrc/ffdec_lib/src/com/jpexs/decompiler/flash/search/ActionSearchResult.java b/libsrc/ffdec_lib/src/com/jpexs/decompiler/flash/search/ActionSearchResult.java index e34f12f16..17097454f 100644 --- a/libsrc/ffdec_lib/src/com/jpexs/decompiler/flash/search/ActionSearchResult.java +++ b/libsrc/ffdec_lib/src/com/jpexs/decompiler/flash/search/ActionSearchResult.java @@ -19,6 +19,7 @@ package com.jpexs.decompiler.flash.search; import com.jpexs.decompiler.flash.SWF; import com.jpexs.decompiler.flash.tags.base.ASMSource; import com.jpexs.decompiler.flash.treeitems.Openable; +import com.jpexs.helpers.AllowedObjectInputStream; import java.io.IOException; import java.io.InputStream; import java.io.ObjectInputStream; @@ -52,7 +53,7 @@ public class ActionSearchResult implements ScriptSearchResult { */ public ActionSearchResult(SWF swf, InputStream is) throws IOException, ScriptNotFoundException { Map asms = swf.getASMs(false); - ObjectInputStream ois = new ObjectInputStream(is); + ObjectInputStream ois = new AllowedObjectInputStream(is); int versionMajor = ois.read(); ois.read(); //minor if (versionMajor != SERIAL_VERSION_MAJOR) { diff --git a/libsrc/ffdec_lib/src/com/jpexs/helpers/AllowedObjectInputStream.java b/libsrc/ffdec_lib/src/com/jpexs/helpers/AllowedObjectInputStream.java new file mode 100644 index 000000000..f0f7d71b0 --- /dev/null +++ b/libsrc/ffdec_lib/src/com/jpexs/helpers/AllowedObjectInputStream.java @@ -0,0 +1,82 @@ +/* + * Copyright (C) 2010-2026 JPEXS + * + * This program is free software: you can redistribute it and/or modify + * it under the terms of the GNU General Public License as published by + * the Free Software Foundation, either version 3 of the License, or + * (at your option) any later version. + * + * This program is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + * GNU General Public License for more details. + * + * You should have received a copy of the GNU General Public License + * along with this program. If not, see . + */ +package com.jpexs.helpers; + +import com.jpexs.decompiler.flash.configuration.SwfSpecificConfiguration; +import com.jpexs.decompiler.flash.configuration.SwfSpecificCustomConfiguration; +import com.jpexs.decompiler.flash.configuration.enums.GridSnapAccuracy; +import com.jpexs.decompiler.flash.configuration.enums.GuidesSnapAccuracy; +import com.jpexs.decompiler.flash.exporters.modes.ExeExportMode; +import com.jpexs.decompiler.flash.importers.TextImportResizeTextBoundsMode; +import java.awt.Color; +import java.io.IOException; +import java.io.InputStream; +import java.io.InvalidClassException; +import java.io.ObjectInputStream; +import java.io.ObjectStreamClass; +import java.util.Arrays; +import java.util.Calendar; +import java.util.List; + +/** + * ObjectInputStream that limits deserialized classes to safe ones. + * @author JPEXS + */ +public class AllowedObjectInputStream extends ObjectInputStream { + private static final List ALLOWED_CLASSES = Arrays.asList( + "java.lang.String", + "java.lang.Number", + "java.lang.Short", + "java.lang.Long", + "java.lang.Integer", + "java.lang.Double", + "java.lang.Float", + "java.lang.Boolean", + "java.util.ArrayList", + "java.util.LinkedList", + "java.util.HashSet", + "java.util.LinkedHashSet", + "java.util.HashMap", + "java.util.LinkedHashMap", + SwfSpecificConfiguration.class.getName(), + SwfSpecificCustomConfiguration.class.getName(), + ExeExportMode.class.getName(), + TextImportResizeTextBoundsMode.class.getName(), + Color.class.getName(), + GridSnapAccuracy.class.getName(), + GuidesSnapAccuracy.class.getName(), + Calendar.class.getName() + ); + + public AllowedObjectInputStream(InputStream in) throws IOException { + super(in); + } + + @Override + protected Class resolveClass(ObjectStreamClass desc) + throws IOException, ClassNotFoundException { + + String className = desc.getName(); + + if (!ALLOWED_CLASSES.contains(className)) { + throw new InvalidClassException( + "Unauthorized deserialization attempt", className); + } + + return super.resolveClass(desc); + } +} diff --git a/src/com/jpexs/decompiler/flash/gui/SearchResultsStorage.java b/src/com/jpexs/decompiler/flash/gui/SearchResultsStorage.java index 363ed433b..706efc8bf 100644 --- a/src/com/jpexs/decompiler/flash/gui/SearchResultsStorage.java +++ b/src/com/jpexs/decompiler/flash/gui/SearchResultsStorage.java @@ -24,12 +24,14 @@ import com.jpexs.decompiler.flash.search.ActionSearchResult; import com.jpexs.decompiler.flash.search.ScriptNotFoundException; import com.jpexs.decompiler.flash.search.ScriptSearchResult; import com.jpexs.decompiler.flash.treeitems.Openable; +import com.jpexs.helpers.AllowedObjectInputStream; import java.io.ByteArrayInputStream; import java.io.ByteArrayOutputStream; import java.io.File; import java.io.FileInputStream; import java.io.FileOutputStream; import java.io.IOException; +import java.io.ObjectInputFilter; import java.io.ObjectInputStream; import java.io.ObjectOutputStream; import java.util.ArrayList; @@ -164,7 +166,7 @@ public class SearchResultsStorage { try { ByteArrayInputStream bais1 = new ByteArrayInputStream(itemData); int kind = bais1.read(); - ObjectInputStream ois = new ObjectInputStream(bais1); + ObjectInputStream ois = new AllowedObjectInputStream(bais1); List resultData = readByteList(ois); for (int i = 0; i < resultData.size(); i++) { try { @@ -194,7 +196,7 @@ public class SearchResultsStorage { public synchronized void load() throws IOException { String configFile = getConfigFile(); if (new File(configFile).exists()) { - try (FileInputStream fis = new FileInputStream(configFile); ObjectInputStream ois = new ObjectInputStream(fis)) { + try (FileInputStream fis = new FileInputStream(configFile); ObjectInputStream ois = new AllowedObjectInputStream(fis)) { int major = ois.read(); ois.read(); // minor if (major != SERIAL_VERSION_MAJOR) { //incompatible version