[Keycloak-10162] Usage of ObjectInputStream without checking the obje…

…ct types
keycloak · May 9, 2020 · 2e34cd4 · 2e34cd4
1 parent 75acc27
commit 2e34cd4
Show file tree

Hide file tree

Showing 3 changed files with 20 additions and 2 deletions.
diff --git a/common/src/main/java/org/keycloak/common/util/KerberosSerializationUtils.java b/common/src/main/java/org/keycloak/common/util/KerberosSerializationUtils.java
@@ -18,12 +18,12 @@
 package org.keycloak.common.util;
 
 import org.ietf.jgss.GSSCredential;
+import sun.misc.ObjectInputFilter;
 
 import javax.security.auth.kerberos.KerberosTicket;
 import java.io.ByteArrayInputStream;
 import java.io.ByteArrayOutputStream;
 import java.io.IOException;
-import java.io.ObjectInput;
 import java.io.ObjectInputStream;
 import java.io.ObjectOutput;
 import java.io.ObjectOutputStream;
@@ -109,9 +109,11 @@ private static String serialize(Serializable obj) throws IOException {
     private static Object deserialize(String serialized) throws ClassNotFoundException, IOException {
         byte[] bytes = Base64.decode(serialized);
         ByteArrayInputStream bis = new ByteArrayInputStream(bytes);
-        ObjectInput in = null;
+        ObjectInputStream in = null;
         try {
+            ObjectInputFilter filter = ObjectInputFilter.Config.createFilter("javax.security.auth.kerberos.KerberosTicket;javax.security.auth.kerberos.KerberosPrincipal;javax.security.auth.kerberos.KeyImpl;java.net.InetAddress;java.util.Date;!*");
             in = new ObjectInputStream(bis);
+            ObjectInputFilter.Config.setObjectInputFilter(in, filter);
             return in.readObject();
         } finally {
             try {

diff --git a/core/src/main/java/org/keycloak/KeycloakPrincipal.java b/core/src/main/java/org/keycloak/KeycloakPrincipal.java
@@ -17,6 +17,10 @@
 
 package org.keycloak;
 
+import sun.misc.ObjectInputFilter;
+
+import java.io.IOException;
+import java.io.ObjectInputStream;
 import java.io.Serializable;
 import java.security.Principal;
 
@@ -63,4 +67,10 @@ public int hashCode() {
     public String toString() {
         return name;
     }
+
+    private void readObject(ObjectInputStream in) throws IOException, ClassNotFoundException {
+        ObjectInputFilter filter = ObjectInputFilter.Config.createFilter("org.keycloak.KeycloakSecurityContext;org.keycloak.KeycloakPrincipal;!*");
+        ObjectInputFilter.Config.setObjectInputFilter(in, filter);
+        in.defaultReadObject();
+    }
 }
diff --git a/core/src/main/java/org/keycloak/KeycloakSecurityContext.java b/core/src/main/java/org/keycloak/KeycloakSecurityContext.java
@@ -21,6 +21,7 @@
 import org.keycloak.representations.AccessToken;
 import org.keycloak.representations.IDToken;
 import org.keycloak.util.JsonSerialization;
+import sun.misc.ObjectInputFilter;
 
 import java.io.IOException;
 import java.io.ObjectInputStream;
@@ -85,6 +86,11 @@ private void writeObject(ObjectOutputStream out) throws IOException {
     }
 
     private void readObject(ObjectInputStream in) throws IOException, ClassNotFoundException {
+        if(ObjectInputFilter.Config.getObjectInputFilter(in) == null)
+        {
+            ObjectInputFilter filter = ObjectInputFilter.Config.createFilter("org.keycloak.KeycloakSecurityContext;!*");
+            ObjectInputFilter.Config.setObjectInputFilter(in, filter);
+        }
         in.defaultReadObject();
 
         token = parseToken(tokenString, AccessToken.class);