|
 |
f79a0c |
--- src/main/java/com/fasterxml/jackson/databind/deser/BeanDeserializerFactory.java.orig 2017-11-01 09:57:37.083991374 +0000
|
|
|
f79a0c |
+++ src/main/java/com/fasterxml/jackson/databind/deser/BeanDeserializerFactory.java 2017-11-01 10:00:58.032279501 +0000
|
|
|
f79a0c |
@@ -48,16 +48,29 @@
|
|
|
f79a0c |
static {
|
|
|
f79a0c |
Set<String> s = new HashSet<String>();
|
|
|
f79a0c |
// Courtesy of [https://github.com/kantega/notsoserial]:
|
|
|
f79a0c |
- // (and wrt [databind#1599]
|
|
|
f79a0c |
+ // (and wrt [databind#1599])
|
|
|
f79a0c |
s.add("org.apache.commons.collections.functors.InvokerTransformer");
|
|
|
f79a0c |
s.add("org.apache.commons.collections.functors.InstantiateTransformer");
|
|
|
f79a0c |
s.add("org.apache.commons.collections4.functors.InvokerTransformer");
|
|
|
f79a0c |
s.add("org.apache.commons.collections4.functors.InstantiateTransformer");
|
|
|
f79a0c |
+ // 05-Aug-2017, tatu: as per [https://github.com/mbechler/marshalsec/blob/master/marshalsec.pdf]
|
|
|
f79a0c |
+ // this is NOT likely to be exploitable via Jackson. But keep excluded just in case.
|
|
|
f79a0c |
s.add("org.codehaus.groovy.runtime.ConvertedClosure");
|
|
|
f79a0c |
s.add("org.codehaus.groovy.runtime.MethodClosure");
|
|
|
f79a0c |
s.add("org.springframework.beans.factory.ObjectFactory");
|
|
|
f79a0c |
s.add("com.sun.org.apache.xalan.internal.xsltc.trax.TemplatesImpl");
|
|
|
f79a0c |
s.add("org.apache.xalan.xsltc.trax.TemplatesImpl");
|
|
|
f79a0c |
+ // [databind#1680]: may or may not be problem, take no chance
|
|
|
f79a0c |
+ s.add("com.sun.rowset.JdbcRowSetImpl");
|
|
|
f79a0c |
+ // [databind#1737]; JDK provided
|
|
|
f79a0c |
+ s.add("java.util.logging.FileHandler");
|
|
|
f79a0c |
+ s.add("java.rmi.server.UnicastRemoteObject");
|
|
|
f79a0c |
+ // [databind#1737]; 3rd party
|
|
|
f79a0c |
+ s.add("org.springframework.aop.support.AbstractBeanFactoryPointcutAdvisor");
|
|
|
f79a0c |
+ s.add("org.springframework.beans.factory.config.PropertyPathFactoryBean");
|
|
|
f79a0c |
+ s.add("com.mchange.v2.c3p0.JndiRefForwardingDataSource");
|
|
|
f79a0c |
+ s.add("com.mchange.v2.c3p0.WrapperConnectionPoolDataSource");
|
|
|
f79a0c |
+
|
|
|
f79a0c |
DEFAULT_NO_DESER_CLASS_NAMES = Collections.unmodifiableSet(s);
|
|
|
f79a0c |
}
|
|
|
f79a0c |
|