diff --git a/pom.xml b/pom.xml index 10348ef0466a..9fd710658982 100644 --- a/pom.xml +++ b/pom.xml @@ -54,6 +54,7 @@ iluwatar_java-design-patterns ${project.artifactId} Java Design Patterns + 1.1.3 abstract-factory @@ -248,6 +249,12 @@ ${system-lambda.version} test + + io.github.pixee + java-security-toolkit + + ${versions.java-security-toolkit} + diff --git a/serialized-entity/pom.xml b/serialized-entity/pom.xml index 754089acf182..1a8a7c9ba1f3 100644 --- a/serialized-entity/pom.xml +++ b/serialized-entity/pom.xml @@ -22,6 +22,10 @@ com.h2database h2 + + io.github.pixee + java-security-toolkit + diff --git a/serialized-entity/src/main/java/com/iluwatar/serializedentity/CountrySchemaSql.java b/serialized-entity/src/main/java/com/iluwatar/serializedentity/CountrySchemaSql.java index 971f875c6b81..026ca10869aa 100644 --- a/serialized-entity/src/main/java/com/iluwatar/serializedentity/CountrySchemaSql.java +++ b/serialized-entity/src/main/java/com/iluwatar/serializedentity/CountrySchemaSql.java @@ -24,6 +24,7 @@ */ package com.iluwatar.serializedentity; +import io.github.pixee.security.ObjectInputFilters; import java.io.ByteArrayInputStream; import java.io.ByteArrayOutputStream; import java.io.IOException; @@ -109,6 +110,7 @@ public int selectCountry() throws IOException, ClassNotFoundException { Blob countryBlob = rs.getBlob("country"); ByteArrayInputStream baos = new ByteArrayInputStream(countryBlob.getBytes(1, (int) countryBlob.length())); ObjectInputStream ois = new ObjectInputStream(baos); + ObjectInputFilters.enableObjectFilterIfUnprotected(ois); country = (Country) ois.readObject(); LOGGER.info("Country: " + country); } diff --git a/tolerant-reader/pom.xml b/tolerant-reader/pom.xml index c6716bb845cd..650fc22864a4 100644 --- a/tolerant-reader/pom.xml +++ b/tolerant-reader/pom.xml @@ -39,6 +39,10 @@ junit-jupiter-engine test + + io.github.pixee + java-security-toolkit + diff --git a/tolerant-reader/src/main/java/com/iluwatar/tolerantreader/RainbowFishSerializer.java b/tolerant-reader/src/main/java/com/iluwatar/tolerantreader/RainbowFishSerializer.java index 62410bde22f6..de257f9b3a0e 100644 --- a/tolerant-reader/src/main/java/com/iluwatar/tolerantreader/RainbowFishSerializer.java +++ b/tolerant-reader/src/main/java/com/iluwatar/tolerantreader/RainbowFishSerializer.java @@ -24,6 +24,7 @@ */ package com.iluwatar.tolerantreader; +import io.github.pixee.security.ObjectInputFilters; import java.io.FileInputStream; import java.io.FileOutputStream; import java.io.IOException; @@ -90,6 +91,7 @@ public static RainbowFish readV1(String filename) throws IOException, ClassNotFo try (var fileIn = new FileInputStream(filename); var objIn = new ObjectInputStream(fileIn)) { + ObjectInputFilters.enableObjectFilterIfUnprotected(objIn); map = (Map) objIn.readObject(); }