Restlet 2.1.4中 匪夷所思的ObjectRepresentation的构造函数

1public ObjectRepresentation(Representation serializedRepresentation,
2            final ClassLoader classLoader) throws IOException,
3            ClassNotFoundException, IllegalArgumentException {
4        super(MediaType.APPLICATION_JAVA_OBJECT);
5
6
7        if (serializedRepresentation.getMediaType().equals(
8                MediaType. APPLICATION_JAVA_OBJECT)) {
9            if (!VARIANT_OBJECT_BINARY_SUPPORTED ) {
10                throw new IllegalArgumentException(
11                        "SECURITY WARNING: The usage of ObjectInputStream when "
12                                + "deserializing binary presentations from unstrusted "
13                                + "sources can lead to malicious attacks. As pointed "
14                                + "here (https://github.com/restlet/restlet-framework-java/issues/778), "
15                                + "the ObjectInputStream class is able to force the JVM to execute unwanted "
16                                + "Java code. Thus, the support of such format has been disactivated "
17                                + "by default. You can activate this support by turning on the following system property: "
18                                + "org.restlet.representation.ObjectRepresentation.VARIANT_OBJECT_BINARY_SUPPORTED." );
19            }
20            setMediaType(MediaType.APPLICATION_JAVA_OBJECT );
21            InputStream is = serializedRepresentation.getStream();
22            ObjectInputStream ois = null;
23            if (classLoader != null) {
24                ois = new ObjectInputStream(is) {
25                    @Override
26                    protected Class<?> resolveClass(
27                            java.io.ObjectStreamClass desc)
28                            throws java.io.IOException,
29                            java.lang.ClassNotFoundException {
30                        return Class
31                                . forName(desc.getName(), false, classLoader);
32                    }
33                };
34            } else {
35                ois = new ObjectInputStream(is);
36            }
37
38
39            this.object = (T) ois.readObject();
40
41
42            if (is.read() != -1) {
43                throw new IOException(
44                        "The input stream has not been fully read.");
45            }
46
47
48            ois.close();
49        } else if (VARIANT_OBJECT_XML_SUPPORTED
50                && serializedRepresentation.getMediaType().equals(
51                        MediaType.APPLICATION_JAVA_OBJECT_XML )) {
52            if (!VARIANT_OBJECT_XML_SUPPORTED ) {
53                throw new IllegalArgumentException(
54                        "SECURITY WARNING: The usage of XMLDecoder when "
55                                + "deserializing XML presentations from unstrusted "
56                                + "sources can lead to malicious attacks. As pointed "
57                                + "here (http://blog.diniscruz.com/2013/08/using-xmldecoder-to-execute-server-side.html), "
58                                + "the XMLDecoder class is able to force the JVM to "
59                                + "execute unwanted Java code described inside the XML "
60                                + "file. Thus, the support of such format has been "
61                                + "disactivated by default. You can activate this "
62                                + "support by turning on the following system property: "
63                                + "org.restlet.representation.ObjectRepresentation.VARIANT_OBJECT_XML_SUPPORTED." );
64            }
65            setMediaType(MediaType.APPLICATION_JAVA_OBJECT_XML );
66            InputStream is = serializedRepresentation.getStream();
67            java.beans.XMLDecoder decoder = new java.beans.XMLDecoder(is);
68            this.object = (T) decoder.readObject();
69
70
71            if (is.read() != -1) {
72                throw new IOException(
73                        "The input stream has not been fully read.");
74            }
75
76
77            decoder.close();
78        }
79        throw new IllegalArgumentException(
80                "The serialized representation must have this media type: "
81                        + MediaType.APPLICATION_JAVA_OBJECT .toString()
82                        + " or this one: "
83                        + MediaType.APPLICATION_JAVA_OBJECT_XML .toString());
84    }
85