Java序列化与反序列化详细安全指南

import java.io.ObjectInputFilter;
import java.io.ObjectInputStream;
import java.io.ByteArrayInputStream;
import java.io.IOException;
import java.io.Serializable;

// 假设我们只允许这个MyDataClass被反序列化
class MyDataClass implements Serializable {
    private static final long serialVersionUID = 1L;
    String name;
    int value;

    public MyDataClass(String name, int value) {
        this.name = name;
        this.value = value;
    }

    @Override
    public String toString() {
        return "MyDataClass{name='" + name + "', value=" + value + "}";
    }
}

// 假设有一个不允许被反序列化的恶意类（攻击者可能尝试注入）
class MaliciousClass implements Serializable {
    private static final long serialVersionUID = 1L;
    String command;

    public MaliciousClass(String command) {
        this.command = command;
    }

    // 恶意构造的readObject方法，可能触发RCE
    private void readObject(java.io.ObjectInputStream in) throws IOException, ClassNotFoundException {
        in.defaultReadObject();
        System.out.println("MaliciousClass readObject called! Executing: " + command);
        // Runtime.getRuntime().exec(command); // 真实的攻击会在这里
    }
}

public class DeserializationFilterExample {

    public static void main(String[] args) throws IOException, ClassNotFoundException {
        // 模拟一个序列化的MyDataClass
        byte[] goodData = serialize(new MyDataClass("safe data", 123));

        // 模拟一个序列化的MaliciousClass
        byte[] badData = serialize(new MaliciousClass("rm -rf /"));

        // 1. 使用ObjectInputFilter进行白名单过滤
        System.out.println("--- Using ObjectInputFilter (Whitelist) ---");
        try (ByteArrayInputStream bis = new ByteArrayInputStream(goodData);
             ObjectInputStream ois = new ObjectInputStream(bis)) {

            // 设置过滤器：只允许MyDataClass及其内部类型（如String, int）通过
            ObjectInputFilter filter = ObjectInputFilter.Config.createFilter(
                "java.base/*;com.example.MyDataClass;!*" // 允许java.base下的所有，允许MyDataClass，拒绝其他所有
            );
            ois.setObjectInputFilter(filter);

            MyDataClass obj = (MyDataClass) ois.readObject();
            System.out.println("Successfully deserialized: " + obj);

        } catch (Exception e) {
            System.err.println("Deserialization failed for good data (unexpected): " + e.getMessage());
        }

        try (ByteArrayInputStream bis = new ByteArrayInputStream(badData);
             ObjectInputStream ois = new ObjectInputStream(bis)) {

            ObjectInputFilter filter = ObjectInputFilter.Config.createFilter(
                "java.base/*;com.example.MyDataClass;!*"
            );
            ois.setObjectInputFilter(filter);

            System.out.println("Attempting to deserialize malicious data...");
            Object obj = ois.readObject(); // 这里会抛出异常
            System.out.println("Unexpectedly deserialized: " + obj);

        } catch (java.io.InvalidClassException e) {
            System.err.println("Successfully blocked malicious class: " + e.getMessage());
        } catch (Exception e) {
            System.err.println("Deserialization failed for malicious data: " + e.getMessage());
        }

        // 2. 不使用过滤器（模拟旧版本或未配置的情况）
        System.out.println("\n--- Without ObjectInputFilter ---");
        try (ByteArrayInputStream bis = new ByteArrayInputStream(badData);
             ObjectInputStream ois = new ObjectInputStream(bis)) {
            System.out.println("Attempting to deserialize malicious data without filter...");
            Object obj = ois.readObject(); // 此时MaliciousClass的readObject会被调用
            System.out.println("Deserialized (potentially dangerous): " + obj);
        } catch (Exception e) {
            System.err.println("Deserialization failed without filter (unexpected): " + e.getMessage());
        }
    }

    // 辅助方法：将对象序列化为字节数组
    private static byte[] serialize(Serializable obj) throws IOException {
        java.io.ByteArrayOutputStream bos = new java.io.ByteArrayOutputStream();
        java.io.ObjectOutputStream oos = new java.io.ObjectOutputStream(bos);
        oos.writeObject(obj);
        oos.flush();
        return bos.toByteArray();
    }
}