[COLLECTIONS-721] functors.InvokerTransformer backward incompatibility bug

• Type: Bug
• Status: Closed
• Priority: Major
• Resolution: Not A Bug
• Affects Version/s: 4.1, 4.2, 4.3
• Labels: performance
• Flags: Important
• Assignee: Unassigned
• Reporter: xia0c
• Created: 16/Jun/19 21:48
• Updated: 24/Jul/19 18:57
• Resolved: 24/Jul/19 18:56

Description

The following code snippets throw a NotSerializableException. It works well before commons-collections4 4.0 and commons-collection3. When I update it to 4.1 or newer versions, it failed.

	@Test
	public void Demo() throws IOException{
		InvokerTransformer transformer = new InvokerTransformer("toString", new Class[]{}, new Object[]{});
        Queue priorityQueue = new PriorityQueue(2, new TransformingComparator(transformer));
        priorityQueue.add(1);
        
        ByteArrayOutputStream bout = new ByteArrayOutputStream();
        ObjectOutputStream out = new ObjectOutputStream(bout);
        out.writeObject(priorityQueue);
		
		}

Issue Links

• is related to: COLLECTIONS-580 Arbitrary remote code execution with InvokerTransformer