Spring/spring-framework
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Deprecate SerializationUtils#deserialize

Browse Source 
Since SerializationUtils#deserialize is based on Java's serialization
mechanism, it can be the source of Remote Code Execution (RCE)
vulnerabilities.

Closes gh-28075
This commit is contained in:
Loïc Ledoyen
2022-02-18 18:31:17 +01:00
committed by Sam Brannen
parent e681e713d4
commit 7f7fb58dd0
3 changed files with 23 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
spring-context-support/src/main/java/org/springframework/cache/jcache/interceptor/CacheResultInterceptor.java vendored
View File

@@ -150,7 +150,7 @@ class CacheResultInterceptor extends AbstractKeyCacheInterceptor<CacheResultOper
@Nullable
private static <T extends Throwable> T cloneException(T exception) {
try {
return (T) SerializationUtils.deserialize(SerializationUtils.serialize(exception));
return SerializationUtils.clone(exception);
}
catch (Exception ex) {
return null; // exception parameter cannot be cloned