org.alfresco.repo.admin

Class UnserializerValidatorBootstrap

java.lang.Object

org.springframework.extensions.surf.util.AbstractLifecycleBean

org.alfresco.repo.admin.UnserializerValidatorBootstrap

All Implemented Interfaces:

EventListener, org.springframework.beans.factory.Aware, org.springframework.context.ApplicationContextAware, org.springframework.context.ApplicationListener

public class UnserializerValidatorBootstrap
extends org.springframework.extensions.surf.util.AbstractLifecycleBean

Bootstrap unserializer validator: a bootstrap bean that checks that the classes that would favor Java unserialize remote code execution are not available. Check is needed because libs could be introduced by the application server.

See MNT-15170 for details.

Checked conditions:
org.apache.xalan.xsltc.trax.TemplatesImpl and org.springframework.core.SerializableTypeWrapper;
org.apache.commons.collections.functors.InvokerTransformer org.apache.commons.collections.functors.InstantiateFactory org.apache.commons.collections.functors.InstantiateTransformer org.apache.commons.collections.functors.PrototypeCloneFactory org.apache.commons.collections.functors.PrototypeSerializationFactory org.apache.commons.collections.functors.WhileClosure org.apache.commons.collections.functors.CloneTransformer org.apache.commons.collections.functors.ForClosure

Field Summary

Fields

Modifier and Type	Field and Description
static String	PROPERTY_UNSERIALIZER_VALIDATOR_ENABLED The name of the global enablement property.

Fields inherited from class org.springframework.extensions.surf.util.AbstractLifecycleBean

log

Constructor Summary

Constructors

Constructor and Description
UnserializerValidatorBootstrap()

Method Summary

Modifier and Type	Method and Description
void	bootstrap() Bootstrap unserializer validator.
boolean	hasPerformedBootstrap() Determine if bootstrap was performed?
protected void	onBootstrap(org.springframework.context.ApplicationEvent event)
protected void	onShutdown(org.springframework.context.ApplicationEvent event)
void	setLog(boolean logEnabled) Deprecated. Was never used
void	setProperties(Properties properties)

Methods inherited from class org.springframework.extensions.surf.util.AbstractLifecycleBean

getApplicationContext, onApplicationEvent, setApplicationContext

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Field Detail

PROPERTY_UNSERIALIZER_VALIDATOR_ENABLED

public static final String PROPERTY_UNSERIALIZER_VALIDATOR_ENABLED

The name of the global enablement property.

See Also:

Constant Field Values

Constructor Detail

UnserializerValidatorBootstrap

public UnserializerValidatorBootstrap()

Method Detail

setLog

public void setLog(boolean logEnabled)

Deprecated. Was never used

hasPerformedBootstrap

public boolean hasPerformedBootstrap()

Determine if bootstrap was performed?

Returns:

true => bootstrap was performed

setProperties

public void setProperties(Properties properties)

bootstrap

public void bootstrap()

Bootstrap unserializer validator.

onBootstrap

protected void onBootstrap(org.springframework.context.ApplicationEvent event)

Specified by:

onBootstrap in class org.springframework.extensions.surf.util.AbstractLifecycleBean

onShutdown

protected void onShutdown(org.springframework.context.ApplicationEvent event)

Specified by:

onShutdown in class org.springframework.extensions.surf.util.AbstractLifecycleBean