Remove the Java serialization round trip from the bundled Click HiddenField

openam-core/src/main/java/org/openidentityplatform/openam/click/control/HiddenField.java

@@ -19,11 +19,8 @@
  */
 package org.openidentityplatform.openam.click.control;
 
-import org.openidentityplatform.openam.click.util.ClickUtils;
 import org.openidentityplatform.openam.click.util.HtmlStringBuffer;
 
-import java.io.IOException;
-import java.io.Serializable;
 import java.sql.Time;
 import java.sql.Timestamp;
 import java.util.Date;
@@ -42,13 +39,11 @@
  * <li>Long</li>
  * <li>Short</li>
  * <li>String</li>
- * <li>Serializable</li>
  * </ul></blockquote>
  * <p>
- * Serializable non-primitive objects will be serialized, compressed and
- * Base64 encoded, using {@link ClickUtils#encode(Object)}
- * method, and decoded using the corresponding
- * {@link ClickUtils#decode(String)} method.
+ * Other value classes are not supported. Arbitrary Serializable objects used to be carried in
+ * the field as a Base64 encoded Java serialization stream and read back with
+ * ObjectInputStream.readObject(); that round-trip was removed under GHSA-7j4m-m698-57hp.
  *
  * <h2>HiddenField Example</h2>
  *
@@ -313,18 +308,13 @@ public void bindRequestValue() {
                 long time = Long.parseLong(aValue);
                 setValueObject(new Date(time));
 
-            } else if (Serializable.class.isAssignableFrom(valueClass)) {
-                try {
-                    setValueObject(ClickUtils.decode(aValue));
-                } catch (ClassNotFoundException cnfe) {
-                    String msg =
-                        "could not decode value for hidden field: " + aValue;
-                    throw new RuntimeException(msg, cnfe);
-                } catch (IOException ioe) {
-                    String msg =
-                        "could not decode value for hidden field: " + aValue;
-                    throw new RuntimeException(msg, ioe);
-                }
+            // GHSA-7j4m-m698-57hp: a further branch used to hand any other Serializable value
+            // class to ClickUtils.decode(), which ran ObjectInputStream.readObject() over a
+            // request parameter with no filter. Nothing in the product bound such a field, so the
+            // branch and the encode/decode pair behind it were removed rather than filtered. Such
+            // a submission now takes the same path as any other value class this method does not
+            // parse: setValue(aValue) below, which refuses it because a String is not of the
+            // declared value class.
             } else {
                 setValue(aValue);
             }
@@ -364,15 +354,6 @@ public void render(HtmlStringBuffer buffer) {
             String dateStr = String.valueOf(((Date) getValueObject()).getTime());
             buffer.appendAttributeEscaped("value", dateStr);
 
-        } else if (getValueObject() instanceof Serializable) {
-            try {
-                buffer.appendAttribute("value", ClickUtils.encode(getValueObject()));
-            } catch (IOException ioe) {
-                String msg =
-                    "could not encode value for hidden field: "
-                    + getValueObject();
-                throw new RuntimeException(msg, ioe);
-            }
         } else {
             buffer.appendAttributeEscaped("value", getValue());
         }

openam-core/src/main/java/org/openidentityplatform/openam/click/util/ClickUtils.java

@@ -19,17 +19,12 @@
  */
 package org.openidentityplatform.openam.click.util;
 
-import java.io.ByteArrayInputStream;
-import java.io.ByteArrayOutputStream;
 import java.io.Closeable;
 import java.io.File;
 import java.io.FileOutputStream;
 import java.io.IOException;
 import java.io.InputStream;
-import java.io.ObjectInputStream;
-import java.io.ObjectOutputStream;
 import java.io.OutputStream;
-import java.io.Serializable;
 import java.io.UnsupportedEncodingException;
 import java.lang.reflect.InvocationTargetException;
 import java.lang.reflect.Method;
@@ -48,7 +43,6 @@
 import java.util.MissingResourceException;
 import java.util.ResourceBundle;
 import java.util.TreeMap;
-import java.util.zip.GZIPInputStream;
 import java.util.zip.GZIPOutputStream;
 
 import jakarta.servlet.ServletContext;
@@ -72,7 +66,6 @@
 
 import org.apache.click.util.Format;
 import org.apache.click.util.MessagesMap;
-import org.apache.commons.codec.binary.Base64;
 import org.apache.commons.io.IOUtils;
 import org.apache.commons.lang.ClassUtils;
 import org.apache.commons.lang.StringUtils;
@@ -1705,95 +1698,11 @@ public static void deployFileList(ServletContext servletContext,
 
     }
 
-    /**
-     * Return an encoded version of the <code>Serializable</code> object. The object
-     * will be serialized, compressed and Base 64 encoded.
-     *
-     * @param object the object to encode
-     * @return a serialized, compressed and Base 64 string encoding of the
-     * given object
-     * @throws IOException if an I/O error occurs
-     * @throws IllegalArgumentException if the object parameter is null, or if
-     *      the object is not Serializable
-     */
-    public static String encode(Object object) throws IOException {
-        if (object == null) {
-            throw new IllegalArgumentException("null object parameter");
-        }
-        if (!(object instanceof Serializable)) {
-            throw new IllegalArgumentException("parameter not Serializable");
-        }
-
-        ByteArrayOutputStream bos = null;
-        GZIPOutputStream gos = null;
-        ObjectOutputStream oos = null;
-
-        try {
-            bos = new ByteArrayOutputStream();
-            gos = new GZIPOutputStream(bos);
-            oos = new ObjectOutputStream(gos);
-
-            oos.writeObject(object);
-
-        } finally {
-            close(oos);
-            close(gos);
-            close(bos);
-        }
-
-        Base64 base64 = new Base64();
-
-        try {
-            byte[] byteData = base64.encode(bos.toByteArray());
-
-            return new String(byteData);
-
-        } catch (Throwable t) {
-            String message =
-                    "error occurred Base64 encoding: " + object + " : " + t;
-            throw new IOException(message);
-        }
-    }
-
-    /**
-     * Return an object from the {@link #encode(Object)} string.
-     *
-     * @param string the encoded string
-     * @return an object from the encoded
-     * @throws ClassNotFoundException if the class could not be instantiated
-     * @throws IOException if an data I/O error occurs
-     */
-    public static Object decode(String string)
-            throws ClassNotFoundException, IOException {
-
-        Base64 base64 = new Base64();
-        byte[] byteData = null;
-
-        try {
-            byteData = base64.decode(string.getBytes());
-
-        } catch (Throwable t) {
-            String message =
-                    "error occurred Base64 decoding: " + string + " : " + t;
-            throw new IOException(message);
-        }
-
-        ByteArrayInputStream bis = null;
-        GZIPInputStream gis = null;
-        ObjectInputStream ois = null;
-        try {
-            bis = new ByteArrayInputStream(byteData);
-            gis = new GZIPInputStream(bis);
-            ois = new ObjectInputStream(gis);
-
-            return ois.readObject();
-
-        } finally {
-            close(ois);
-            close(gis);
-            close(bis);
-        }
-    }
+    // GHSA-7j4m-m698-57hp: encode(Object)/decode(String) used to round-trip a Serializable
+    // through Base64 + GZIP + ObjectInputStream.readObject(), with no ObjectInputFilter and no
+    // class allowlist. Their only user was HiddenField, on both sides, and no page in the product
+    // bound a HiddenField to a value class that reached them - so rather than filter a sink with
+    // no legitimate caller, the pair and the HiddenField branches that used them were removed.
 
     /**
      * Builds a cookie string containing a username and password.