LegacyConsole/jpexs-decompiler
3
0
Fork 0
mirror of https://git.huckle.dev/Huckles-Minecraft-Archive/jpexs-decompiler.git synced 2026-07-17 21:38:10 +00:00
Code Issues Packages Projects Releases Wiki Activity

fix: allow only safe classes on deserialization

Browse Source
This commit is contained in:
Jindra Petřík
2026-05-08 13:58:33 +02:00
parent 66391cbb75
commit c89c542f7a
5 changed files with 92 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files

3
libsrc/ffdec_lib/src/com/jpexs/decompiler/flash/configuration/LegacyConfigurationStorage.java
View File

@@ -16,6 +16,7 @@
*/
package com.jpexs.decompiler.flash.configuration;
import com.jpexs.helpers.AllowedObjectInputStream;
import java.io.BufferedOutputStream;
import java.io.FileInputStream;
import java.io.FileOutputStream;
@@ -42,7 +43,7 @@ public class LegacyConfigurationStorage implements ConfigurationStorage {
@Override
public Map<String, Object> loadFromFile(String file) {
try (ObjectInputStream ois = new ObjectInputStream(new FileInputStream(file))) {
try (ObjectInputStream ois = new AllowedObjectInputStream(new FileInputStream(file))) {
@SuppressWarnings("unchecked")
Map<String, Object> cfg = (HashMap<String, Object>) ois.readObject();

3
libsrc/ffdec_lib/src/com/jpexs/decompiler/flash/search/ABCSearchResult.java
View File

@@ -24,6 +24,7 @@ import com.jpexs.decompiler.flash.abc.ScriptPack;
import com.jpexs.decompiler.flash.helpers.GraphTextWriter;
import com.jpexs.decompiler.flash.treeitems.Openable;
import com.jpexs.decompiler.graph.DottedChain;
import com.jpexs.helpers.AllowedObjectInputStream;
import java.io.IOException;
import java.io.InputStream;
import java.io.ObjectInputStream;
@@ -96,7 +97,7 @@ public class ABCSearchResult implements Serializable, ScriptSearchResult {
*/
@SuppressWarnings("unchecked")
public ABCSearchResult(Openable openable, InputStream is) throws IOException, ScriptNotFoundException {
ObjectInputStream ois = new ObjectInputStream(is);
ObjectInputStream ois = new AllowedObjectInputStream(is);
int versionMajor = ois.read();
ois.read(); //minor
if (versionMajor == 1) {

3
libsrc/ffdec_lib/src/com/jpexs/decompiler/flash/search/ActionSearchResult.java
View File

@@ -19,6 +19,7 @@ package com.jpexs.decompiler.flash.search;
import com.jpexs.decompiler.flash.SWF;
import com.jpexs.decompiler.flash.tags.base.ASMSource;
import com.jpexs.decompiler.flash.treeitems.Openable;
import com.jpexs.helpers.AllowedObjectInputStream;
import java.io.IOException;
import java.io.InputStream;
import java.io.ObjectInputStream;
@@ -52,7 +53,7 @@ public class ActionSearchResult implements ScriptSearchResult {
*/
public ActionSearchResult(SWF swf, InputStream is) throws IOException, ScriptNotFoundException {
Map<String, ASMSource> asms = swf.getASMs(false);
ObjectInputStream ois = new ObjectInputStream(is);
ObjectInputStream ois = new AllowedObjectInputStream(is);
int versionMajor = ois.read();
ois.read(); //minor
if (versionMajor != SERIAL_VERSION_MAJOR) {

82
libsrc/ffdec_lib/src/com/jpexs/helpers/AllowedObjectInputStream.java Normal file
View File

@@ -0,0 +1,82 @@
/*
* Copyright (C) 2010-2026 JPEXS
*
* This program is free software: you can redistribute it and/or modify
* it under the terms of the GNU General Public License as published by
* the Free Software Foundation, either version 3 of the License, or
* (at your option) any later version.
*
* This program is distributed in the hope that it will be useful,
* but WITHOUT ANY WARRANTY; without even the implied warranty of
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
* GNU General Public License for more details.
*
* You should have received a copy of the GNU General Public License
* along with this program. If not, see <http://www.gnu.org/licenses/>.
*/
package com.jpexs.helpers;
import com.jpexs.decompiler.flash.configuration.SwfSpecificConfiguration;
import com.jpexs.decompiler.flash.configuration.SwfSpecificCustomConfiguration;
import com.jpexs.decompiler.flash.configuration.enums.GridSnapAccuracy;
import com.jpexs.decompiler.flash.configuration.enums.GuidesSnapAccuracy;
import com.jpexs.decompiler.flash.exporters.modes.ExeExportMode;
import com.jpexs.decompiler.flash.importers.TextImportResizeTextBoundsMode;
import java.awt.Color;
import java.io.IOException;
import java.io.InputStream;
import java.io.InvalidClassException;
import java.io.ObjectInputStream;
import java.io.ObjectStreamClass;
import java.util.Arrays;
import java.util.Calendar;
import java.util.List;
/**
* ObjectInputStream that limits deserialized classes to safe ones.
* @author JPEXS
*/
public class AllowedObjectInputStream extends ObjectInputStream {
private static final List<String> ALLOWED_CLASSES = Arrays.asList(
"java.lang.String",
"java.lang.Number",
"java.lang.Short",
"java.lang.Long",
"java.lang.Integer",
"java.lang.Double",
"java.lang.Float",
"java.lang.Boolean",
"java.util.ArrayList",
"java.util.LinkedList",
"java.util.HashSet",
"java.util.LinkedHashSet",
"java.util.HashMap",
"java.util.LinkedHashMap",
SwfSpecificConfiguration.class.getName(),
SwfSpecificCustomConfiguration.class.getName(),
ExeExportMode.class.getName(),
TextImportResizeTextBoundsMode.class.getName(),
Color.class.getName(),
GridSnapAccuracy.class.getName(),
GuidesSnapAccuracy.class.getName(),
Calendar.class.getName()
);
public AllowedObjectInputStream(InputStream in) throws IOException {
super(in);
}
@Override
protected Class<?> resolveClass(ObjectStreamClass desc)
throws IOException, ClassNotFoundException {
String className = desc.getName();
if (!ALLOWED_CLASSES.contains(className)) {
throw new InvalidClassException(
"Unauthorized deserialization attempt", className);
}
return super.resolveClass(desc);
}
}