Blame SOURCES/groovy-CVE-2015-3253-and-CVE-2016-6814.patch

053625
--- groovy-1.8.9/src/main/org/codehaus/groovy/runtime/MethodClosure.java~	2017-08-23 11:14:43.972873435 +0200
053625
+++ groovy-1.8.9/src/main/org/codehaus/groovy/runtime/MethodClosure.java	2017-08-23 11:21:34.318169659 +0200
053625
@@ -18,6 +18,7 @@
053625
 import groovy.lang.Closure;
053625
 import groovy.lang.MetaMethod;
053625
 
053625
+import java.io.IOException;
053625
 import java.util.List;
053625
 
053625
 
053625
@@ -30,8 +31,10 @@
053625
  */
053625
 public class MethodClosure extends Closure {
053625
 
053625
+    public static boolean ALLOW_RESOLVE = false;
053625
+
053625
     private String method;
053625
-    
053625
+
053625
     public MethodClosure(Object owner, String method) {
053625
         super(owner);
053625
         this.method = method;
053625
@@ -59,6 +62,20 @@
053625
     protected Object doCall(Object arguments) {
053625
         return InvokerHelper.invokeMethod(getOwner(), method, arguments);
053625
     }
053625
+
053625
+    private Object readResolve() {
053625
+        if (ALLOW_RESOLVE) {
053625
+            return this;
053625
+        }
053625
+        throw new UnsupportedOperationException();
053625
+    }
053625
+
053625
+    private void readObject(java.io.ObjectInputStream stream) throws IOException, ClassNotFoundException {
053625
+        if (ALLOW_RESOLVE) {
053625
+            stream.defaultReadObject();
053625
+        }
053625
+        throw new UnsupportedOperationException();
053625
+    }
053625
     
053625
     public Object getProperty(String property) {
053625
         if ("method".equals(property)) {