From b1c0ca75ca38a7a8b50bfdfdf2c324169a6ddf02 Mon Sep 17 00:00:00 2001
From: Michael Simacek <msimacek@redhat.com>
Date: Mon, 19 Mar 2018 16:01:57 +0100
Subject: [PATCH] Disallow EventData deserialization by default

---
 .../src/main/java/org/slf4j/ext/EventData.java      | 21 +++++++++++++++------
 1 file changed, 15 insertions(+), 6 deletions(-)

diff --git a/slf4j-ext/src/main/java/org/slf4j/ext/EventData.java b/slf4j-ext/src/main/java/org/slf4j/ext/EventData.java
index dc5b502..fa5c125 100644
--- a/slf4j-ext/src/main/java/org/slf4j/ext/EventData.java
+++ b/slf4j-ext/src/main/java/org/slf4j/ext/EventData.java
@@ -76,12 +76,21 @@ public class EventData implements Serializable {
      */
     @SuppressWarnings("unchecked")
     public EventData(String xml) {
-        ByteArrayInputStream bais = new ByteArrayInputStream(xml.getBytes());
-        try {
-            XMLDecoder decoder = new XMLDecoder(bais);
-            this.eventData = (Map<String, Object>) decoder.readObject();
-        } catch (Exception e) {
-            throw new EventException("Error decoding " + xml, e);
+        if ("1".equals(System.getProperty("org.slf4j.ext.allowInsecureDeserialization"))) {
+            ByteArrayInputStream bais = new ByteArrayInputStream(xml.getBytes());
+            try {
+                XMLDecoder decoder = new XMLDecoder(bais);
+                this.eventData = (Map<String, Object>) decoder.readObject();
+            } catch (Exception e) {
+                throw new EventException("Error decoding " + xml, e);
+            }
+        } else {
+            throw new UnsupportedOperationException(
+                    "Constructing EventData from XML is vulnerable to remote " +
+                    "excution and is not allowed by default. If you're " +
+                    "completely sure the source data is trusted, you can enable " +
+                    "it by setting org.slf4j.ext.allowInsecureDeserialization " +
+                    "JVM property to 1");
         }
     }
 
-- 
2.14.3