Examples with ObjectInputStreamWithClassLoader org.apache.activemq.artemis.utils.ObjectInputStreamWithClassLoader used on opensource projects

Example 1 with ObjectInputStreamWithClassLoader

use of org.apache.activemq.artemis.utils.ObjectInputStreamWithClassLoader in project activemq-artemis by apache.

the class ConsumedObjectMessage method build.

@Override
public void build(Response.ResponseBuilder builder) {
    buildHeaders(builder);
    if (readObject == null) {
        int size = message.getBodyBuffer().readInt();
        if (size > 0) {
            byte[] body = new byte[size];
            message.getBodyBuffer().readBytes(body);
            ByteArrayInputStream bais = new ByteArrayInputStream(body);
            try (ObjectInputStreamWithClassLoader ois = new ObjectInputStreamWithClassLoader(bais)) {
                if (options != null) {
                    ois.setWhiteList(options.getDeserializationWhiteList());
                    ois.setBlackList(options.getDeserializationBlackList());
                }
                readObject = ois.readObject();
            } catch (Exception e) {
                throw new RuntimeException(e);
            }
        }
    }
    builder.entity(readObject);
}

Example 2 with ObjectInputStreamWithClassLoader

use of org.apache.activemq.artemis.utils.ObjectInputStreamWithClassLoader in project activemq-artemis by apache.

the class ActiveMQObjectMessage method getObject.

// lazy deserialize the Object the first time the client requests it
@Override
public Serializable getObject() throws JMSException {
    if (data == null || data.length == 0) {
        return null;
    }
    try (ObjectInputStreamWithClassLoader ois = new ObjectInputStreamWithClassLoader(new ByteArrayInputStream(data))) {
        String blackList = getDeserializationBlackList();
        if (blackList != null) {
            ois.setBlackList(blackList);
        }
        String whiteList = getDeserializationWhiteList();
        if (whiteList != null) {
            ois.setWhiteList(whiteList);
        }
        Serializable object = (Serializable) ois.readObject();
        return object;
    } catch (Exception e) {
        JMSException je = new JMSException(e.getMessage());
        je.setStackTrace(e.getStackTrace());
        throw je;
    }
}

Example 3 with ObjectInputStreamWithClassLoader

use of org.apache.activemq.artemis.utils.ObjectInputStreamWithClassLoader in project activemq-artemis by apache.

the class ObjectInputStreamWithClassLoaderTest method testWhiteBlackListSystemProperty.

@Test
public void testWhiteBlackListSystemProperty() throws Exception {
    File serailizeFile = new File(temporaryFolder.getRoot(), "testclass.bin");
    ObjectOutputStream outputStream = new ObjectOutputStream(new FileOutputStream(serailizeFile));
    try {
        outputStream.writeObject(new TestClass1());
        outputStream.flush();
    } finally {
        outputStream.close();
    }
    System.setProperty(ObjectInputStreamWithClassLoader.BLACKLIST_PROPERTY, "system.defined.black.list");
    System.setProperty(ObjectInputStreamWithClassLoader.WHITELIST_PROPERTY, "system.defined.white.list");
    try {
        ObjectInputStreamWithClassLoader ois = new ObjectInputStreamWithClassLoader(new FileInputStream(serailizeFile));
        String bList = ois.getBlackList();
        String wList = ois.getWhiteList();
        assertEquals("wrong black list: " + bList, "system.defined.black.list", bList);
        assertEquals("wrong white list: " + wList, "system.defined.white.list", wList);
        ois.close();
    } finally {
        System.clearProperty(ObjectInputStreamWithClassLoader.BLACKLIST_PROPERTY);
        System.clearProperty(ObjectInputStreamWithClassLoader.WHITELIST_PROPERTY);
    }
}

Example 4 with ObjectInputStreamWithClassLoader

use of org.apache.activemq.artemis.utils.ObjectInputStreamWithClassLoader in project activemq-artemis by apache.

the class ObjectInputStreamWithClassLoaderTest method readSerializedObject.

private Exception readSerializedObject(String whiteList, String blackList, File serailizeFile) {
    Exception result = null;
    ObjectInputStreamWithClassLoader ois = null;
    try {
        ois = new ObjectInputStreamWithClassLoader(new FileInputStream(serailizeFile));
        ois.setWhiteList(whiteList);
        ois.setBlackList(blackList);
        ois.readObject();
    } catch (Exception e) {
        result = e;
    } finally {
        try {
            ois.close();
        } catch (IOException e) {
            result = e;
        }
    }
    return result;
}

Example 5 with ObjectInputStreamWithClassLoader

use of org.apache.activemq.artemis.utils.ObjectInputStreamWithClassLoader in project activemq-artemis by apache.

the class ObjectInputStreamWithClassLoaderTest method testClassLoaderIsolationWithProxy.

@Test
public void testClassLoaderIsolationWithProxy() throws Exception {
    ClassLoader originalClassLoader = Thread.currentThread().getContextClassLoader();
    try {
        AnObject originalProxy = (AnObject) Proxy.newProxyInstance(AnObject.class.getClassLoader(), new Class[] { AnObject.class }, new AnObjectInvocationHandler());
        originalProxy.setMyInt(100);
        byte[] bytes = ObjectInputStreamWithClassLoaderTest.toBytes(originalProxy);
        ClassLoader testClassLoader = ObjectInputStreamWithClassLoaderTest.newClassLoader(this.getClass(), ActiveMQTestBase.class, Assert.class);
        Thread.currentThread().setContextClassLoader(testClassLoader);
        ByteArrayInputStream bais = new ByteArrayInputStream(bytes);
        ObjectInputStreamWithClassLoader ois = new ObjectInputStreamWithClassLoader(bais);
        Runnable toRun = (Runnable) testClassLoader.loadClass(ProxyReader.class.getName()).newInstance();
        toRun.getClass().getField("ois").set(toRun, ois);
        toRun.getClass().getField("testClassLoader").set(toRun, testClassLoader);
        toRun.getClass().getField("originalProxy").set(toRun, originalProxy);
        toRun.run();
    } finally {
        Thread.currentThread().setContextClassLoader(originalClassLoader);
    }
}