X-Git-Url: http://gitweb.fperrin.net/?a=blobdiff_plain;f=src%2Fcom%2Fhughes%2Fandroid%2Futil%2FPersistentObjectCache.java;h=938142c341591d7551dfa16dc5ebe55be7e859b5;hb=83d9dc7cd871082a82c2dd0dbb7a0ceabd7c83a0;hp=c95f5037b232022e7ea7e0ea0ef49d8a6a91edbe;hpb=c65149247819e0719d2aad891954a389a607e830;p=Dictionary.git diff --git a/src/com/hughes/android/util/PersistentObjectCache.java b/src/com/hughes/android/util/PersistentObjectCache.java index c95f503..938142c 100644 --- a/src/com/hughes/android/util/PersistentObjectCache.java +++ b/src/com/hughes/android/util/PersistentObjectCache.java @@ -41,10 +41,10 @@ import java.util.Map; public class PersistentObjectCache { private final File dir; - private final Map objects = new HashMap(); + private final Map objects = new HashMap<>(); class ConstrainedOIS extends ObjectInputStream { - public ConstrainedOIS(InputStream in) throws IOException { + ConstrainedOIS(InputStream in) throws IOException { super(in); } @@ -52,16 +52,16 @@ public class PersistentObjectCache { String name = desc.getName(); // Note: try to avoid adding more classes. // LinkedHashMap is already more than enough for a DoS - if (!name.equals(ArrayList.class.getName()) && - !name.equals(HashMap.class.getName()) && - !name.equals(LinkedHashMap.class.getName()) && - !name.equals(String.class.getName()) && - !name.equals(DictionaryApplication.DictionaryConfig.class.getName()) && - !name.equals(DictionaryInfo.class.getName()) && - !name.equals(DictionaryInfo.IndexInfo.class.getName())) { - throw new InvalidClassException("Not allowed to deserialize class", name); + if (name.equals(String.class.getName()) || + name.equals(DictionaryInfo.IndexInfo.class.getName()) || + name.equals(ArrayList.class.getName()) || + name.equals(HashMap.class.getName()) || + name.equals(DictionaryInfo.class.getName()) || + name.equals(DictionaryApplication.DictionaryConfig.class.getName()) || + name.equals(LinkedHashMap.class.getName())) { + return super.resolveClass(desc); } - return super.resolveClass(desc); + throw new InvalidClassException("Not allowed to deserialize class", name); } }