diff --git a/src/main/java/io/github/pixee/security/ObjectInputStreams.java b/src/main/java/io/github/pixee/security/ValidatingObjectInputStreams.java similarity index 77% rename from src/main/java/io/github/pixee/security/ObjectInputStreams.java rename to src/main/java/io/github/pixee/security/ValidatingObjectInputStreams.java index 4fc120f..54fbd04 100644 --- a/src/main/java/io/github/pixee/security/ObjectInputStreams.java +++ b/src/main/java/io/github/pixee/security/ValidatingObjectInputStreams.java @@ -8,18 +8,19 @@ /** * This type exposes helper methods that will help defend against Java deserialization attacks - * leveraging {@link ObjectInputStream} APIs. + * leveraging {@link ObjectInputStream} APIs by wrapping it in an Apache Commons IO {@link ValidatingObjectInputStream} + * that is configued to reject types that are known to be leveraged in deserialization attacks * *

For more information on deserialization checkout the OWASP * Cheat Sheet. */ -public final class ObjectInputStreams { +public final class ValidatingObjectInputStreams { /** * Private no-op constructor to prevent accidental initialization of this class */ - private ObjectInputStreams() {} + private ValidatingObjectInputStreams() {} /** * This method returns a wrapped {@link ObjectInputStream} that protects against deserialization @@ -29,7 +30,7 @@ private ObjectInputStreams() {} * @return an {@link ObjectInputStream} which is safe against all publicly known gadgets * @throws IOException if the underlying creation of {@link ObjectInputStream} fails */ - public static ObjectInputStream createValidatingObjectInputStream(final InputStream ois) + public static ObjectInputStream from(final InputStream ois) throws IOException { final ValidatingObjectInputStream is = new ValidatingObjectInputStream(ois); for (String gadget : UnwantedTypes.dangerousClassNameTokens()) { diff --git a/src/test/java/io/github/pixee/security/ObjectInputStreamsTest.java b/src/test/java/io/github/pixee/security/ValidatingObjectInputStreamsTest.java similarity index 91% rename from src/test/java/io/github/pixee/security/ObjectInputStreamsTest.java rename to src/test/java/io/github/pixee/security/ValidatingObjectInputStreamsTest.java index 24a1d84..f733d91 100644 --- a/src/test/java/io/github/pixee/security/ObjectInputStreamsTest.java +++ b/src/test/java/io/github/pixee/security/ValidatingObjectInputStreamsTest.java @@ -15,7 +15,7 @@ import static org.junit.jupiter.api.Assertions.assertThrows; import static org.junit.jupiter.api.Assertions.fail; -final class ObjectInputStreamsTest { +final class ValidatingObjectInputStreamsTest { private static DiskFileItem gadget; // this is an evil gadget type private static byte[] serializedGadget; // this the serialized bytes of that gadget @@ -41,7 +41,7 @@ static void setup() throws IOException { @Test void validating_ois_works() throws Exception { ObjectInputStream ois = - ObjectInputStreams.createValidatingObjectInputStream(new ByteArrayInputStream(serializedGadget)); + ValidatingObjectInputStreams.from(new ByteArrayInputStream(serializedGadget)); assertThrows( InvalidClassException.class, () -> {