From 35b8acb52a7c52e6250c39cfb1bdf35692e0a030 Mon Sep 17 00:00:00 2001 From: fourbites Date: Fri, 20 Mar 2026 15:18:36 +0100 Subject: [PATCH] Allow L (array) types --- .../java/com/threerings/io/ObjectInputStream.java | 12 +++++++++++- 1 file changed, 11 insertions(+), 1 deletion(-) diff --git a/core/src/main/java/com/threerings/io/ObjectInputStream.java b/core/src/main/java/com/threerings/io/ObjectInputStream.java index 82fd1bce5..0ca770352 100644 --- a/core/src/main/java/com/threerings/io/ObjectInputStream.java +++ b/core/src/main/java/com/threerings/io/ObjectInputStream.java @@ -248,9 +248,19 @@ public class ObjectInputStream extends DataInputStream { // validate the class name against the whitelist before loading if (_allowedPrefixes != null) { + // strip array encoding to get the component class name + // e.g. "[Lcom.threerings.Foo;" -> "com.threerings.Foo" + String checkName = cname; + while (checkName.startsWith("[")) { + checkName = checkName.substring(1); + } + if (checkName.startsWith("L") && checkName.endsWith(";")) { + checkName = checkName.substring(1, checkName.length() - 1); + } + boolean allowed = false; for (String prefix : _allowedPrefixes) { - if (cname.startsWith(prefix)) { + if (checkName.startsWith(prefix)) { allowed = true; break; }