This is an automated email from the ASF dual-hosted git repository. jacopoc pushed a commit to branch release24.09 in repository https://gitbox.apache.org/repos/asf/ofbiz-framework.git
commit eb6c54aba6810c5f9c905c21f068ec4b8c71b764 Author: Jacopo Cappellato <[email protected]> AuthorDate: Thu Apr 23 18:36:52 2026 +0200 Reverted: commit 6e8d8620ac The commit 6e8d8620ac, "Fixed: Remove support for serialization and deserialization of custom Java objects in XmlSerializer for security reasons", implemented a defense-in-depth against deserialization attacks by disabling suport for custom objects. While deserializing custom objects, without proper checks, is not recommended, and we should consider to abandon this feature, this commit re-adds it, because of some regressions (e.g. errors scheduling email notifications for sales orders). (cherry picked from commit 20f8f532aabf8a2139d7270036f7f3062f6beec0) --- .../ofbiz/entity/serialize/XmlSerializer.java | 34 +++++++++++++++++----- 1 file changed, 26 insertions(+), 8 deletions(-) diff --git a/framework/entity/src/main/java/org/apache/ofbiz/entity/serialize/XmlSerializer.java b/framework/entity/src/main/java/org/apache/ofbiz/entity/serialize/XmlSerializer.java index deaeb38012..ce954005a7 100644 --- a/framework/entity/src/main/java/org/apache/ofbiz/entity/serialize/XmlSerializer.java +++ b/framework/entity/src/main/java/org/apache/ofbiz/entity/serialize/XmlSerializer.java @@ -20,6 +20,7 @@ package org.apache.ofbiz.entity.serialize; import java.io.FileNotFoundException; import java.io.IOException; +import java.io.Serializable; import java.lang.ref.WeakReference; import java.math.BigDecimal; import java.math.RoundingMode; @@ -47,8 +48,10 @@ import javax.xml.bind.DatatypeConverter; import javax.xml.parsers.ParserConfigurationException; import org.apache.ofbiz.base.util.Debug; +import org.apache.ofbiz.base.util.StringUtil; import org.apache.ofbiz.base.util.UtilGenerics; import org.apache.ofbiz.base.util.UtilMisc; +import org.apache.ofbiz.base.util.UtilObject; import org.apache.ofbiz.base.util.UtilXml; import org.apache.ofbiz.entity.Delegator; import org.apache.ofbiz.entity.GenericPK; @@ -254,11 +257,18 @@ public class XmlSerializer { } public static Element serializeCustom(Object object, Document document) throws SerializeException { - Debug.logError("Serialization of custom Java objects (cus-obj) is no longer supported. " - + "This feature has been removed for security reasons. Object class: " - + object.getClass().getName(), MODULE); - throw new SerializeException("Serialization of custom Java objects is not supported. " - + "Object class: " + object.getClass().getName()); + if (object instanceof Serializable) { + byte[] objBytes = UtilObject.getBytes(object); + if (objBytes == null) { + throw new SerializeException("Unable to serialize object; null byte array returned"); + } + String byteHex = StringUtil.toHexString(objBytes); + Element element = document.createElement("cus-obj"); + // this is hex encoded so does not need to be in a CDATA block + element.appendChild(document.createTextNode(byteHex)); + return element; + } + throw new SerializeException("Cannot serialize object of class " + object.getClass().getName()); } public static Element makeElement(String elementName, Object value, Document document) { @@ -455,9 +465,17 @@ public class XmlSerializer { public static Object deserializeCustom(Element element) throws SerializeException { String tagName = element.getLocalName(); if ("cus-obj".equals(tagName)) { - Debug.logError("Deserialization of cus-obj elements is no longer supported. " - + "This feature has been removed for security reasons.", MODULE); - throw new SerializeException("Deserialization of cus-obj elements is not supported."); + String value = UtilXml.elementValue(element); + if (value != null) { + byte[] valueBytes = StringUtil.fromHexString(value); + if (valueBytes != null) { + Object obj = UtilObject.getObject(valueBytes); + if (obj != null) { + return obj; + } + } + } + throw new SerializeException("Problem deserializing object from byte array + " + element.getLocalName()); } throw new SerializeException("Cannot deserialize element named " + element.getLocalName()); }
