Improved: Refactor ‘UtilObject#getObjectException’

(OFBIZ-11261)

This moves most of the behavior inside the ‘SafeObjectInputStream’
class which has been refactored too.


git-svn-id: https://svn.apache.org/repos/asf/ofbiz/ofbiz-framework/trunk@1869004 13f79535-47bb-0310-9956-ffa450edef68

build.gradle

@@ -307,7 +307,7 @@ checkstyle {
     // the sum of errors that were present before introducing the
     // ‘checkstyle’ tool present in the framework and in the official
     // plugins.
-    maxErrors = 37880
+    maxErrors = 37864
     // Currently there are a lot of errors so we need to temporarily
     // hide them to avoid polluting the terminal output.
     showViolations = false

framework/base/src/main/java/org/apache/ofbiz/base/util/SafeObjectInputStream.java

@@ -1,4 +1,4 @@
-/*******************************************************************************
+/*
  * Licensed to the Apache Software Foundation (ASF) under one
  * or more contributor license agreements.  See the NOTICE file
  * distributed with this work for additional information
@@ -15,77 +15,61 @@
  * KIND, either express or implied.  See the License for the
  * specific language governing permissions and limitations
  * under the License.
- *******************************************************************************/
+ */
 package org.apache.ofbiz.base.util;
 
+import static java.util.stream.Collectors.collectingAndThen;
+import static java.util.stream.Collectors.joining;
+import static org.apache.ofbiz.base.util.UtilProperties.getPropertyValue;
+
 import java.io.IOException;
 import java.io.InputStream;
+import java.io.ObjectInputStream;
 import java.io.ObjectStreamClass;
-import java.lang.reflect.Proxy;
-import java.util.List;
+import java.util.Arrays;
 import java.util.regex.Pattern;
 
 /**
- * ObjectInputStream
+ * SafeObjectInputStream
  *
+ * <p> An implementation of {@link java.io.ObjectInputStream} that ensure that
+ * only authorized class can be read from it.
  */
-public class SafeObjectInputStream extends java.io.ObjectInputStream {
-
-    private ClassLoader classloader;
-    private Pattern WHITELIST_PATTERN = null;
+public final class SafeObjectInputStream extends ObjectInputStream {
+    private static final String[] DEFAULT_WHITELIST_PATTERN = {
+            "byte\\[\\]", "foo", "SerializationInjector",
+            "\\[Z", "\\[B", "\\[S", "\\[I", "\\[J", "\\[F", "\\[D", "\\[C",
+            "java..*", "sun.util.calendar..*", "org.apache.ofbiz..*" };
 
-    public SafeObjectInputStream(InputStream in, ClassLoader loader) throws IOException {
-        super(in);
-        this.classloader = loader;
-    }
+    /** The regular expression used to match serialized types. */
+    private final Pattern whitelistPattern;
 
-    public SafeObjectInputStream(InputStream in, ClassLoader loader, List<String> whitelist) throws IOException {
+    /**
+     * Instantiates a safe object input stream.
+     *
+     * @param in  the input stream to read
+     * @throws IOException when reading is not possible.
+     */
+    public SafeObjectInputStream(InputStream in) throws IOException {
         super(in);
-        this.classloader = loader;
-        StringBuilder bld = new StringBuilder("(");
-        for (int i = 0; i < whitelist.size(); i++) {
-            bld.append(whitelist.get(i));
-            if (i != whitelist.size() - 1) {
-                bld.append("|");
-            }
-        }
-        bld.append(")");
-        WHITELIST_PATTERN = Pattern.compile(bld.toString());
+        String safeObjectsProp = getPropertyValue("SafeObjectInputStream", "ListOfSafeObjectsForInputStream");
+        String[] whitelist = safeObjectsProp.isEmpty() ? DEFAULT_WHITELIST_PATTERN : safeObjectsProp.split(",");
+        whitelistPattern = Arrays.stream(whitelist)
+                .map(String::trim)
+                .filter(str -> !str.isEmpty())
+                .collect(collectingAndThen(joining("|", "(", ")"), Pattern::compile));
     }
 
-
-    /**
-     * @see java.io.ObjectInputStream#resolveClass(java.io.ObjectStreamClass)
-     */
     @Override
     protected Class<?> resolveClass(ObjectStreamClass classDesc) throws IOException, ClassNotFoundException {
-        if (!WHITELIST_PATTERN.matcher(classDesc.getName()).find()) {
-            Debug.logWarning("***Incompatible class***: " + classDesc.getName() + 
-                    ". Please see OFBIZ-10837.  Report to dev ML if you use OFBiz without changes. "
-                    + "Else follow https://s.apache.org/45war"
-                    , "SafeObjectInputStream");
+        if (!whitelistPattern.matcher(classDesc.getName()).find()) {
+            Debug.logWarning("***Incompatible class***: "
+                    + classDesc.getName()
+                    + ". Please see OFBIZ-10837.  Report to dev ML if you use OFBiz without changes. "
+                    + "Else follow https://s.apache.org/45war",
+                    "SafeObjectInputStream");
             throw new ClassCastException("Incompatible class: " + classDesc.getName());
         }
-
-        return ObjectType.loadClass(classDesc.getName(), classloader);
-    }
-
-    /**
-     * @see java.io.ObjectInputStream#resolveProxyClass(java.lang.String[])
-     */
-    @Override
-    protected Class<?> resolveProxyClass(String[] interfaces) throws IOException, ClassNotFoundException {
-        Class<?>[] cinterfaces = new Class<?>[interfaces.length];
-        for (int i = 0; i < interfaces.length; i++) {
-            cinterfaces[i] = classloader.loadClass(interfaces[i]);
-        }
-        //Proxy.getInvocationHandler(proxy)
-
-        try {
-            return Proxy.getProxyClass(classloader, cinterfaces);
-        } catch (IllegalArgumentException e) {
-            throw new ClassNotFoundException(null, e);
-        }
-
+        return ObjectType.loadClass(classDesc.getName(), Thread.currentThread().getContextClassLoader());
     }
 }

framework/base/src/main/java/org/apache/ofbiz/base/util/UtilObject.java

@@ -23,11 +23,8 @@
 import java.io.IOException;
 import java.io.ObjectOutputStream;
 import java.lang.reflect.Array;
-import java.util.Arrays;
 import java.util.Iterator;
-import java.util.List;
 import java.util.ServiceLoader;
-import java.util.stream.Collectors;
 
 import org.apache.ofbiz.base.lang.Factory;
 import org.apache.ofbiz.base.lang.SourceMonitored;
@@ -86,25 +83,17 @@ public static Object getObject(byte[] bytes) {
         return obj;
     }
 
-    /** Deserialize a byte array back to an object */
+    /**
+     * Deserializes a byte array back to an object.
+     *
+     * @param bytes  the array of bytes
+     * @return the deserialized object.
+     * @throws ClassNotFoundException when the class can not be deserialized.
+     * @throws IOException when a general Input/Output error happen.
+     */
     public static Object getObjectException(byte[] bytes) throws ClassNotFoundException, IOException {
-        String listOfSafeObjectsForInputStream = UtilProperties.getPropertyValue("SafeObjectInputStream",
-                "ListOfSafeObjectsForInputStream");
-        List<String> listOfSafeObjects = null;
-        if (UtilValidate.isNotEmpty(listOfSafeObjectsForInputStream)) {
-            listOfSafeObjects = Arrays.stream(listOfSafeObjectsForInputStream.split(","))
-                    .map(String::trim)
-                    .filter(s -> !s.isEmpty())
-                    .collect(Collectors.toList());
-        } else {
-            listOfSafeObjects = java.util.Arrays.asList("byte\\[\\]", "foo", "SerializationInjector",
-                    "\\[Z","\\[B","\\[S","\\[I","\\[J","\\[F","\\[D","\\[C",
-                    "java..*", "sun.util.calendar..*", "org.apache.ofbiz..*");
-        } // "foo" and, "SerializationInjector" are used in UtilObjectTests::testGetObject
-
-        ClassLoader classloader = Thread.currentThread().getContextClassLoader();
         try (ByteArrayInputStream bis = new ByteArrayInputStream(bytes);
-             SafeObjectInputStream wois = new SafeObjectInputStream(bis, classloader, listOfSafeObjects)) {
+                SafeObjectInputStream wois = new SafeObjectInputStream(bis)) {
             return wois.readObject();
         }
     }