refactoring
parent
8ea5a5d1c8
commit
c169193bc6
@ -1,75 +0,0 @@
|
|||||||
/**
|
|
||||||
* Copyright 2018 Nikita Koksharov
|
|
||||||
*
|
|
||||||
* Licensed under the Apache License, Version 2.0 (the "License");
|
|
||||||
* you may not use this file except in compliance with the License.
|
|
||||||
* You may obtain a copy of the License at
|
|
||||||
*
|
|
||||||
* http://www.apache.org/licenses/LICENSE-2.0
|
|
||||||
*
|
|
||||||
* Unless required by applicable law or agreed to in writing, software
|
|
||||||
* distributed under the License is distributed on an "AS IS" BASIS,
|
|
||||||
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
|
||||||
* See the License for the specific language governing permissions and
|
|
||||||
* limitations under the License.
|
|
||||||
*/
|
|
||||||
package org.redisson.codec;
|
|
||||||
|
|
||||||
import java.util.Collections;
|
|
||||||
import java.util.HashSet;
|
|
||||||
import java.util.Set;
|
|
||||||
|
|
||||||
import com.fasterxml.jackson.databind.BeanDescription;
|
|
||||||
import com.fasterxml.jackson.databind.DeserializationConfig;
|
|
||||||
import com.fasterxml.jackson.databind.deser.ValueInstantiator;
|
|
||||||
import com.fasterxml.jackson.databind.deser.ValueInstantiators.Base;
|
|
||||||
import com.fasterxml.jackson.databind.module.SimpleModule;
|
|
||||||
|
|
||||||
/**
|
|
||||||
* Fix for https://github.com/FasterXML/jackson-databind/issues/1599
|
|
||||||
*
|
|
||||||
* @author Nikita Koksharov
|
|
||||||
*
|
|
||||||
* TODO remove after update to latest version of Jackson
|
|
||||||
*
|
|
||||||
*/
|
|
||||||
public class DefenceModule extends SimpleModule {
|
|
||||||
|
|
||||||
private static final long serialVersionUID = -429891510707420220L;
|
|
||||||
|
|
||||||
public static class DefenceValueInstantiator extends Base {
|
|
||||||
|
|
||||||
protected final static Set<String> DEFAULT_NO_DESER_CLASS_NAMES;
|
|
||||||
static {
|
|
||||||
Set<String> s = new HashSet<String>();
|
|
||||||
// Courtesy of [https://github.com/kantega/notsoserial]:
|
|
||||||
// (and wrt [databind#1599]
|
|
||||||
s.add("org.apache.commons.collections.functors.InvokerTransformer");
|
|
||||||
s.add("org.apache.commons.collections.functors.InstantiateTransformer");
|
|
||||||
s.add("org.apache.commons.collections4.functors.InvokerTransformer");
|
|
||||||
s.add("org.apache.commons.collections4.functors.InstantiateTransformer");
|
|
||||||
s.add("org.codehaus.groovy.runtime.ConvertedClosure");
|
|
||||||
s.add("org.codehaus.groovy.runtime.MethodClosure");
|
|
||||||
s.add("org.springframework.beans.factory.ObjectFactory");
|
|
||||||
s.add("com.sun.org.apache.xalan.internal.xsltc.trax.TemplatesImpl");
|
|
||||||
DEFAULT_NO_DESER_CLASS_NAMES = Collections.unmodifiableSet(s);
|
|
||||||
}
|
|
||||||
|
|
||||||
@Override
|
|
||||||
public ValueInstantiator findValueInstantiator(DeserializationConfig config, BeanDescription beanDesc,
|
|
||||||
ValueInstantiator defaultInstantiator) {
|
|
||||||
if (DEFAULT_NO_DESER_CLASS_NAMES.contains(beanDesc.getClassInfo().getRawType().getName())) {
|
|
||||||
throw new IllegalArgumentException("Illegal type " + beanDesc.getClassInfo().getRawType().getName() + " to deserialize: prevented for security reasons");
|
|
||||||
}
|
|
||||||
|
|
||||||
return super.findValueInstantiator(config, beanDesc, defaultInstantiator);
|
|
||||||
}
|
|
||||||
|
|
||||||
}
|
|
||||||
|
|
||||||
@Override
|
|
||||||
public void setupModule(SetupContext context) {
|
|
||||||
context.addValueInstantiators(new DefenceValueInstantiator());
|
|
||||||
}
|
|
||||||
|
|
||||||
}
|
|
Loading…
Reference in New Issue