Defend against attempts to bypass JVM serial proxy#522
Defend against attempts to bypass JVM serial proxy#522dkhalanskyjb merged 13 commits intoKotlin:masterfrom
Conversation
Also add serialVersionUID for exception classes. This ensures that unrelated changes in these exception classes don't affect the serialized form. The serialVersionUIDs are from 7380325. After running ./gradlew publishToMavenLocal, they were obtained with the serialver tool [1]: $ serialver -classpath .m2/repository/org/jetbrains/kotlinx/kotlinx-datetime-jvm/0.6.2-SNAPSHOT/kotlinx-datetime-jvm-0.6.2-SNAPSHOT.jar:kotlin-stdlib-2.1.0.jar kotlinx.datetime.LocalDate kotlinx.datetime.LocalDateTime kotlinx.datetime.LocalTime kotlinx.datetime.UtcOffset kotlinx.datetime.DateTimeArithmeticException kotlinx.datetime.IllegalTimeZoneException kotlinx.datetime.DateTimeFormatException kotlinx.datetime.internal.format.parser.ParseException kotlinx.datetime.LocalDate: private static final long serialVersionUID = 7026816023079564263L; kotlinx.datetime.LocalDateTime: private static final long serialVersionUID = -4261744960416354711L; kotlinx.datetime.LocalTime: private static final long serialVersionUID = -352249606036216323L; kotlinx.datetime.UtcOffset: private static final long serialVersionUID = -6636773355667981618L; kotlinx.datetime.DateTimeArithmeticException: private static final long serialVersionUID = -3207806170214997982L; kotlinx.datetime.IllegalTimeZoneException: private static final long serialVersionUID = 1159315966274264801L; kotlinx.datetime.DateTimeFormatException: private static final long serialVersionUID = 4231196759387994100L; kotlinx.datetime.internal.format.parser.ParseException: private static final long serialVersionUID = 5691186997393344103L; [1] https://docs.oracle.com/en/java/javase/21/docs/specs/man/serialver.html
|
For 89fd818 serialver now outputs this ( I won't update it here though. The actual value doesn't matter, non-malicious serialization will not use it since it goes through |
I've changed the |
|
I've extracted the changes unrelated to bypassing the proxy into #533. |
|
This PR shouldn' t be merged until |
|
Done. |
|
Thank you! |
No description provided.