From e5aa912f1d824ba4d3f9d0091a356a0da183dd4d Mon Sep 17 00:00:00 2001
From: Thomas Lenz <thomas.lenz@egiz.gv.at>
Date: Fri, 3 Jul 2020 10:46:08 +0200
Subject: add EAAF specific serializer that supports whitelisting of classes

---
 .../core/impl/utils/EaafObjectInputStream.java     | 39 ++++++++++++++++++++++
 1 file changed, 39 insertions(+)
 create mode 100644 eaaf_core_utils/src/main/java/at/gv/egiz/eaaf/core/impl/utils/EaafObjectInputStream.java

(limited to 'eaaf_core_utils/src/main/java/at/gv/egiz/eaaf/core/impl/utils/EaafObjectInputStream.java')

diff --git a/eaaf_core_utils/src/main/java/at/gv/egiz/eaaf/core/impl/utils/EaafObjectInputStream.java b/eaaf_core_utils/src/main/java/at/gv/egiz/eaaf/core/impl/utils/EaafObjectInputStream.java
new file mode 100644
index 00000000..e15c7a37
--- /dev/null
+++ b/eaaf_core_utils/src/main/java/at/gv/egiz/eaaf/core/impl/utils/EaafObjectInputStream.java
@@ -0,0 +1,39 @@
+package at.gv.egiz.eaaf.core.impl.utils;
+
+import java.io.IOException;
+import java.io.InputStream;
+import java.io.InvalidClassException;
+import java.io.ObjectInputStream;
+import java.io.ObjectStreamClass;
+import java.util.List;
+
+import javax.annotation.Nonnull;
+
+public class EaafObjectInputStream extends ObjectInputStream {
+
+  private List<String> allowedClassNames;
+  
+  /**
+   * Object input-stream with internal class validation.
+   * 
+   * @param is Inputstream to deserialize.
+   * @param classNames Whitelisted classnames 
+   * @throws IOException In case of an error
+   */ 
+  public EaafObjectInputStream(@Nonnull InputStream is, @Nonnull List<String> classNames) throws IOException {
+    super(is);
+    this.allowedClassNames = classNames;
+    
+  }
+
+  //Only deserialize instances of our expected class
+  @Override
+  protected Class<?> resolveClass(ObjectStreamClass desc)
+      throws IOException, ClassNotFoundException {
+    if (!allowedClassNames.contains(desc.getName())) {
+      throw new InvalidClassException("Unauthorized deserialization attempt: {}",desc.getName());
+      
+    }
+    return super.resolveClass(desc);
+  }
+}
-- 
cgit v1.2.3