search

kantega / notsoserial

Java Agent which mitigates deserialisation attacks by making certain classes unserializable
Apache License 2.0
183 stars 33 forks source link

Pluggable whitelist/blacklist #15

Open cgoudie opened 8 years ago

cgoudie commented 8 years ago

I would like to see a whitelist/blacklist interface for determining the lists.

Something like: public interface SerializationControl { boolean isWhitelisted(String classname) boolean isBlacklisted(String classname) }

with the default implementation being your configuration reader/writer, but swappable either by way of using an agent argument or system property.

eirbjo commented 8 years ago

I've refactored the agent to have an interface NotSoSerial with a single method onBeforeResolveClass.

The default implementation of this interface implements the current behaviour.

Users may replace the default implementation via the ServiceLoader.

This gives complete control over what should be done. As such this allows the implementation of a custom whitelist / blacklist logic, runtime overrides as mentioned in #14, and also pluggable events as mentioned in #16.

If reuse of default behaviour is wanted, we could discuss refactoring DefaultNotSoSerial to make it easier to customise.

Thought?