1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
|
# HG changeset patch
# User Severin Gehwolf <sgehwolf@redhat.com>
# Date 1371476865 -7200
# Node ID 5dd7618fd14c647d21d765fcc2431c9ee6289ae4
# Parent 60c57caf0348c7eed93900e4395607af759e6ba9
8008132: Better serialization support
Reviewed-by: alanb, hawtin
diff --git a/src/share/classes/java/io/ObjectOutputStream.java b/src/share/classes/java/io/ObjectOutputStream.java
--- jdk/src/share/classes/java/io/ObjectOutputStream.java
+++ jdk/src/share/classes/java/io/ObjectOutputStream.java
@@ -36,6 +36,7 @@
import java.util.concurrent.ConcurrentMap;
import static java.io.ObjectStreamClass.processQueue;
import java.io.SerialCallbackContext;
+import sun.reflect.misc.ReflectUtil;
/**
* An ObjectOutputStream writes primitive data types and graphs of Java objects
@@ -1228,6 +1229,12 @@
}
}
+ private boolean isCustomSubclass() {
+ // Return true if this class is a custom subclass of ObjectOutputStream
+ return getClass().getClassLoader()
+ != ObjectOutputStream.class.getClassLoader();
+ }
+
/**
* Writes class descriptor representing a dynamic proxy class to stream.
*/
@@ -1245,6 +1252,9 @@
}
bout.setBlockDataMode(true);
+ if (isCustomSubclass()) {
+ ReflectUtil.checkPackageAccess(cl);
+ }
annotateProxyClass(cl);
bout.setBlockDataMode(false);
bout.writeByte(TC_ENDBLOCKDATA);
@@ -1271,6 +1281,9 @@
Class cl = desc.forClass();
bout.setBlockDataMode(true);
+ if (isCustomSubclass()) {
+ ReflectUtil.checkPackageAccess(cl);
+ }
annotateClass(cl);
bout.setBlockDataMode(false);
bout.writeByte(TC_ENDBLOCKDATA);
diff --git a/src/share/classes/java/io/ObjectStreamClass.java b/src/share/classes/java/io/ObjectStreamClass.java
--- jdk/src/share/classes/java/io/ObjectStreamClass.java
+++ jdk/src/share/classes/java/io/ObjectStreamClass.java
@@ -50,6 +50,7 @@
import java.util.concurrent.ConcurrentMap;
import sun.misc.Unsafe;
import sun.reflect.ReflectionFactory;
+import sun.reflect.misc.ReflectUtil;
/**
* Serialization's descriptor for classes. It contains the name and
@@ -234,6 +235,13 @@
* @return the <code>Class</code> instance that this descriptor represents
*/
public Class<?> forClass() {
+ if (cl == null) {
+ return null;
+ }
+ ClassLoader ccl = ObjectStreamField.getCallerClassLoader();
+ if (ReflectUtil.needsPackageAccessCheck(ccl, cl.getClassLoader())) {
+ ReflectUtil.checkPackageAccess(cl);
+ }
return cl;
}
diff --git a/src/share/classes/java/io/ObjectStreamField.java b/src/share/classes/java/io/ObjectStreamField.java
--- jdk/src/share/classes/java/io/ObjectStreamField.java
+++ jdk/src/share/classes/java/io/ObjectStreamField.java
@@ -26,6 +26,8 @@
package java.io;
import java.lang.reflect.Field;
+import sun.reflect.Reflection;
+import sun.reflect.misc.ReflectUtil;
/**
* A description of a Serializable field from a Serializable class. An array
@@ -158,9 +160,31 @@
* serializable field
*/
public Class<?> getType() {
+ ClassLoader ccl = getCallerClassLoader();
+ if (ReflectUtil.needsPackageAccessCheck(ccl, type.getClassLoader())) {
+ ReflectUtil.checkPackageAccess(type);
+ }
return type;
}
+ // Returns the invoker's class loader.
+ // This is package private because it is accessed from ObjectStreamClass.
+ // NOTE: This must always be invoked when there is exactly one intervening
+ // frame from the core libraries on the stack between this method's
+ // invocation and the desired invoker. The frame count of 3 is determined
+ // as follows:
+ //
+ // 0: Reflection.getCallerClass
+ // 1: getCallerClassLoader()
+ // 2: ObjectStreamField.getType() or ObjectStreamClass.forClass()
+ // 3: the caller we want to check
+ //
+ // NOTE: copied from java.lang.ClassLoader and modified.
+ static ClassLoader getCallerClassLoader() {
+ Class caller = Reflection.getCallerClass(3);
+ return caller.getClassLoader();
+ }
+
/**
* Returns character encoding of field type. The encoding is as follows:
* <blockquote><pre>
|
