groovy18/groovy-CVE-2015-3253-and-CVE-2016-6814.patch

44 lines
1.3 KiB
Diff
Raw Normal View History

--- groovy-1.8.9/src/main/org/codehaus/groovy/runtime/MethodClosure.java~ 2017-08-23 11:14:43.972873435 +0200
+++ groovy-1.8.9/src/main/org/codehaus/groovy/runtime/MethodClosure.java 2017-08-23 11:21:34.318169659 +0200
@@ -18,6 +18,7 @@
import groovy.lang.Closure;
import groovy.lang.MetaMethod;
+import java.io.IOException;
import java.util.List;
@@ -30,8 +31,10 @@
*/
public class MethodClosure extends Closure {
+ public static boolean ALLOW_RESOLVE = false;
+
private String method;
-
+
public MethodClosure(Object owner, String method) {
super(owner);
this.method = method;
@@ -59,6 +62,20 @@
protected Object doCall(Object arguments) {
return InvokerHelper.invokeMethod(getOwner(), method, arguments);
}
+
+ private Object readResolve() {
+ if (ALLOW_RESOLVE) {
+ return this;
+ }
+ throw new UnsupportedOperationException();
+ }
+
+ private void readObject(java.io.ObjectInputStream stream) throws IOException, ClassNotFoundException {
+ if (ALLOW_RESOLVE) {
+ stream.defaultReadObject();
+ }
+ throw new UnsupportedOperationException();
+ }
public Object getProperty(String property) {
if ("method".equals(property)) {