Minor Description
SonarCloud has highlighted security issues in the use of serialization to save and restore the state of java.util.Random instances.
When reading objects using ObjectInputStream.readObject() the class is first identified and the private readObject() method of the class type is executed (if it is present). If the class is a malicious class then potentially malicious code can be executed.
JDKRandom
Uses serialisation to save the java.util.Random instance to the RandomProviderState.
The code requires that java.util.Random is read using ObjectInputStream.readObject(). To ensure the code only allows java.util.Random to be read the code can adapt the ValidatingObjectInputStream idea from Commons IO to prevent malicious code execution.
JDKRandomBridge
This writes and reads a byte[] using the writeObject and readObject methods of ObjectOutput/InputStream. To avoid use of readObject() the code can be refactored to write the byte[] using the write(byte[]) method of ObjectOutputStream and the readFully(byte[]) method of ObjectInputStream.
Attachments
Issue Links
- links to
