Skip to content

Instantly share code, notes, and snippets.

@hoomanb1

hoomanb1/deserialization fix

Created August 2, 2017 23:11
Download ZIP

Revisions

  1. hoomanb1 created this gist Aug 2, 2017.
    14 changes: 14 additions & 0 deletions deserialization fix
    View file
    Original file line number Diff line number Diff line change
    @@ -0,0 +1,14 @@
    protected Class<?> resolveClass(ObjectStreamClass desc)
    throws IOException, ClassNotFoundException {
    String name = desc.getName();

    if(isBlacklisted(name) ) {
    throw new SecurityException("Deserialization is blocked for security reasons");
    }

    if(isWhitelisted(name) ) {
    throw new SecurityException("Deserialization is blocked for security reasons");
    }

    return super.resolveClass(desc);
    }