AfflictionNetworks/narya
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Rayified: Delay chopping out a substring, check primitives?

Browse Source 
I guess I could validate that the primitive code is the final character
in the string. start == end - 1...
This commit is contained in:
Ray J. Greenwell
2026-03-20 13:28:10 -07:00
parent 0e9b81404a
commit d823feb674
1 changed files with 17 additions and 13 deletions
Download Patch File Download Diff File Expand all files Collapse all files
core/src/main/java/com/threerings/io/ObjectInputStream.java
+13 -9
View File
@@ -279,24 +279,28 @@ public class ObjectInputStream extends DataInputStream
throws IOException throws IOException
{ {
// strip array prefixes to get the component type descriptor // strip array prefixes to get the component type descriptor
int start = 0; int start = 0, end = cname.length();
while (start < cname.length() && cname.charAt(start) == '[') { while (start < end && cname.charAt(start) == '[') {
start++; start++;
} }
String desc = cname.substring(start); if (start < end) {
switch (cname.charAt(start)) {
// primitive descriptors (I, Z, B, S, C, J, F, D) are always safe default: break;
if (!desc.startsWith("L") || !desc.endsWith(";")) { case 'I': case 'Z': case 'B': case 'S': case 'C': case 'J': case 'F': case 'D':
return; return; // primitive descriptors (I, Z, B, S, C, J, F, D) are always safe
}
case 'L':
if (cname.endsWith(";")) {
// extract the class name from "Lcom.threerings.Foo;" // extract the class name from "Lcom.threerings.Foo;"
String className = desc.substring(1, desc.length() - 1); String className = cname.substring(start + 1, end - 1);
for (String prefix : _allowedPrefixes) { for (String prefix : _allowedPrefixes) {
if (className.startsWith(prefix)) { if (className.startsWith(prefix)) {
return; return;
} }
} }
}
}
}
log.warning("Blocked deserialization of non-whitelisted class", log.warning("Blocked deserialization of non-whitelisted class",
"code", code, "class", cname); "code", code, "class", cname);