Skip to content

Defend against attempts to bypass JVM serial proxy #522

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
wants to merge 3 commits into
base: master
Choose a base branch
from

Conversation

lukellmann
Copy link
Contributor

Also add serialVersionUID for exception classes. This ensures that unrelated changes in these exception classes don't affect the serialized form.

The serialVersionUIDs are from 7380325. After running ./gradlew publishToMavenLocal, they were obtained with the serialver tool:

$ serialver -classpath .m2/repository/org/jetbrains/kotlinx/kotlinx-datetime-jvm/0.6.2-SNAPSHOT/kotlinx-datetime-jvm-0.6.2-SNAPSHOT.jar:kotlin-stdlib-2.1.0.jar kotlinx.datetime.LocalDate kotlinx.datetime.LocalDateTime kotlinx.datetime.LocalTime kotlinx.datetime.UtcOffset kotlinx.datetime.DateTimeArithmeticException kotlinx.datetime.IllegalTimeZoneException kotlinx.datetime.DateTimeFormatException kotlinx.datetime.internal.format.parser.ParseException
kotlinx.datetime.LocalDate:    private static final long serialVersionUID = 7026816023079564263L;
kotlinx.datetime.LocalDateTime:    private static final long serialVersionUID = -4261744960416354711L;
kotlinx.datetime.LocalTime:    private static final long serialVersionUID = -352249606036216323L;
kotlinx.datetime.UtcOffset:    private static final long serialVersionUID = -6636773355667981618L;
kotlinx.datetime.DateTimeArithmeticException:    private static final long serialVersionUID = -3207806170214997982L;
kotlinx.datetime.IllegalTimeZoneException:    private static final long serialVersionUID = 1159315966274264801L;
kotlinx.datetime.DateTimeFormatException:    private static final long serialVersionUID = 4231196759387994100L;
kotlinx.datetime.internal.format.parser.ParseException:    private static final long serialVersionUID = 5691186997393344103L;

Also add serialVersionUID for exception classes. This ensures that
unrelated changes in these exception classes don't affect the serialized
form.

The serialVersionUIDs are from 7380325.
After running ./gradlew publishToMavenLocal, they were obtained with the
serialver tool [1]:

$ serialver -classpath .m2/repository/org/jetbrains/kotlinx/kotlinx-datetime-jvm/0.6.2-SNAPSHOT/kotlinx-datetime-jvm-0.6.2-SNAPSHOT.jar:kotlin-stdlib-2.1.0.jar kotlinx.datetime.LocalDate kotlinx.datetime.LocalDateTime kotlinx.datetime.LocalTime kotlinx.datetime.UtcOffset kotlinx.datetime.DateTimeArithmeticException kotlinx.datetime.IllegalTimeZoneException kotlinx.datetime.DateTimeFormatException kotlinx.datetime.internal.format.parser.ParseException
kotlinx.datetime.LocalDate:    private static final long serialVersionUID = 7026816023079564263L;
kotlinx.datetime.LocalDateTime:    private static final long serialVersionUID = -4261744960416354711L;
kotlinx.datetime.LocalTime:    private static final long serialVersionUID = -352249606036216323L;
kotlinx.datetime.UtcOffset:    private static final long serialVersionUID = -6636773355667981618L;
kotlinx.datetime.DateTimeArithmeticException:    private static final long serialVersionUID = -3207806170214997982L;
kotlinx.datetime.IllegalTimeZoneException:    private static final long serialVersionUID = 1159315966274264801L;
kotlinx.datetime.DateTimeFormatException:    private static final long serialVersionUID = 4231196759387994100L;
kotlinx.datetime.internal.format.parser.ParseException:    private static final long serialVersionUID = 5691186997393344103L;

[1] https://docs.oracle.com/en/java/javase/21/docs/specs/man/serialver.html
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

1 participant