Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit e214082c authored by Hao Ke's avatar Hao Ke
Browse files

Set default ClassLoader for Parcel readSerializable API. 

Set the default ClassLoader for the readSerializable(ClassLoader,
Class) API, when the ClassLoader parameter is null.

Doing so could enhance the security of Parcel deserialization,
as it would prevent resolving the Serializable class using unexpected
ClassLoaders.

Test: atest -d android.os.cts.ParcelTest
Bug: 195622897
Change-Id: I6da4b4f817c33e4464d90d1e9775b54793835c92
parent 92a4b54d

core/java/android/os/Parcel.java

+10 −4
Original line number Diff line number Diff line
@@ -4385,6 +4385,9 @@ public final class Parcel { 
     * @return the Serializable object, or null if the Serializable name

     * wasn't found in the parcel.

     *

     * Unlike {@link #readSerializable(ClassLoader, Class)}, it uses the nearest valid class loader

     * up the execution stack to instantiate the Serializable object.

     *

     * @deprecated Use the type-safer version {@link #readSerializable(ClassLoader, Class)} starting

     *       from Android {@link Build.VERSION_CODES#TIRAMISU}.

     */
@@ -4395,9 +4398,11 @@ public final class Parcel { 
    }



    /**

     * Same as {@link #readSerializable()} but accepts {@code loader} parameter

     * as the primary classLoader for resolving the Serializable class; and {@code clazz} parameter

     * as the required type.

     * Same as {@link #readSerializable()} but accepts {@code loader} and {@code clazz} parameters.

     *

     * @param loader A ClassLoader from which to instantiate the Serializable object,

     * or null for the default class loader.

     * @param clazz The type of the object expected.

     *

     * @throws BadParcelableException Throws BadParcelableException if the item to be deserialized

     * is not an instance of that class or any of its children class or there there was an error
@@ -4407,7 +4412,8 @@ public final class Parcel { 
    public <T extends Serializable> T readSerializable(@Nullable ClassLoader loader,

            @NonNull Class<T> clazz) {

        Objects.requireNonNull(clazz);

        return readSerializableInternal(loader, clazz);

        return readSerializableInternal(

                loader == null ? getClass().getClassLoader() : loader, clazz);

    }



    /**