From e214082cb0daea2370e9fb2367b1759a9d274450 Mon Sep 17 00:00:00 2001 From: Hao Ke Date: Mon, 22 Nov 2021 21:46:36 +0000 Subject: [PATCH] Set default ClassLoader for Parcel readSerializable API. Set the default ClassLoader for the readSerializable(ClassLoader, Class) API, when the ClassLoader parameter is null. Doing so could enhance the security of Parcel deserialization, as it would prevent resolving the Serializable class using unexpected ClassLoaders. Test: atest -d android.os.cts.ParcelTest Bug: 195622897 Change-Id: I6da4b4f817c33e4464d90d1e9775b54793835c92 --- core/java/android/os/Parcel.java | 14 ++++++++++---- 1 file changed, 10 insertions(+), 4 deletions(-) diff --git a/core/java/android/os/Parcel.java b/core/java/android/os/Parcel.java index 7bdb6b90c07b8..81ee82b7c1914 100644 --- a/core/java/android/os/Parcel.java +++ b/core/java/android/os/Parcel.java @@ -4385,6 +4385,9 @@ public final class Parcel { * @return the Serializable object, or null if the Serializable name * wasn't found in the parcel. * + * Unlike {@link #readSerializable(ClassLoader, Class)}, it uses the nearest valid class loader + * up the execution stack to instantiate the Serializable object. + * * @deprecated Use the type-safer version {@link #readSerializable(ClassLoader, Class)} starting * from Android {@link Build.VERSION_CODES#TIRAMISU}. */ @@ -4395,9 +4398,11 @@ public final class Parcel { } /** - * Same as {@link #readSerializable()} but accepts {@code loader} parameter - * as the primary classLoader for resolving the Serializable class; and {@code clazz} parameter - * as the required type. + * Same as {@link #readSerializable()} but accepts {@code loader} and {@code clazz} parameters. + * + * @param loader A ClassLoader from which to instantiate the Serializable object, + * or null for the default class loader. + * @param clazz The type of the object expected. * * @throws BadParcelableException Throws BadParcelableException if the item to be deserialized * is not an instance of that class or any of its children class or there there was an error @@ -4407,7 +4412,8 @@ public final class Parcel { public T readSerializable(@Nullable ClassLoader loader, @NonNull Class clazz) { Objects.requireNonNull(clazz); - return readSerializableInternal(loader, clazz); + return readSerializableInternal( + loader == null ? getClass().getClassLoader() : loader, clazz); } /**