Spring/spring-framework
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

MethodInvokeTypeProvider lazily invokes target method (avoiding deserialization exploits)

Browse Source 
Issue: SPR-13656
This commit is contained in:
Juergen Hoeller
2015-11-08 20:27:06 +01:00
parent a1bf941ec4
commit ea2843ecc0
1 changed files with 15 additions and 8 deletions
Download Patch File Download Diff File Expand all files Collapse all files

23
spring-core/src/main/java/org/springframework/core/SerializableTypeWrapper.java
View File

@@ -51,6 +51,7 @@ import org.springframework.util.ReflectionUtils;
* {@link GenericArrayType#getGenericComponentType()}) will be automatically wrapped.
*
* @author Phillip Webb
* @author Juergen Hoeller
* @since 4.0
*/
abstract class SerializableTypeWrapper {
@@ -210,7 +211,7 @@ abstract class SerializableTypeWrapper {
/**
* {@link Serializable} {@link InvocationHandler} used by the Proxied {@link Type}.
* {@link Serializable} {@link InvocationHandler} used by the proxied {@link Type}.
* Provides serialization support and enhances any methods that return {@code Type}
* or {@code Type[]}.
*/
@@ -373,21 +374,27 @@ abstract class SerializableTypeWrapper {
private final int index;
private transient Object result;
private transient Method method;
private transient volatile Object result;
public MethodInvokeTypeProvider(TypeProvider provider, Method method, int index) {
this.provider = provider;
this.methodName = method.getName();
this.index = index;
this.result = ReflectionUtils.invokeMethod(method, provider.getType());
this.method = method;
}
@Override
public Type getType() {
if (this.result instanceof Type || this.result == null) {
return (Type) this.result;
Object result = this.result;
if (result == null) {
// Lazy invocation of the target method
result = ReflectionUtils.invokeMethod(this.method, this.provider.getType());
// Cache the result for further calls
this.result = result;
}
return ((Type[])this.result)[this.index];
return (result instanceof Type[] ? ((Type[]) result)[this.index] : (Type) result);
}
@Override
@@ -397,8 +404,8 @@ abstract class SerializableTypeWrapper {
private void readObject(ObjectInputStream inputStream) throws IOException, ClassNotFoundException {
inputStream.defaultReadObject();
Method method = ReflectionUtils.findMethod(this.provider.getType().getClass(), this.methodName);
this.result = ReflectionUtils.invokeMethod(method, this.provider.getType());
this.method = ReflectionUtils.findMethod(this.provider.getType().getClass(), this.methodName);
Assert.state(this.method.getReturnType() == Type.class || this.method.getReturnType() == Type[].class);
}
}