PVADMIN-50363: Fix CVE-2026-6009 in net.sf.jasperreports:jasperreports

jasperreports/pom.xml

@@ -3,7 +3,7 @@
 	<modelVersion>4.0.0</modelVersion>
 	<groupId>net.sf.jasperreports</groupId>
 	<artifactId>jasperreports</artifactId>
-	<version>6.4.0.3-Rx</version>
+	<version>6.4.0.4-Rx</version>
 	<packaging>jar</packaging>
 	<name>JasperReports</name>
 	<url>http://jasperreports.sourceforge.net</url>
@@ -179,13 +179,9 @@
 		<repository>
 			<id>RXLOGIX-thirdparty</id>
 			<name>RXLogix Thirdparty Repository</name>
-			<url>http://10.100.21.16:8080/repository/thirdparty</url>
+			<url>https://nexus-repo-eng.rxlogix.com/repository/thirdparty/</url>
+<!--			<url>http://localhost:8081/repository/thirdparty/</url>-->
 		</repository>
-		<snapshotRepository>
-			<id>jr-ce-snapshots</id>
-			<name>JasperReports CE Snapshots</name>
-			<url>http://jaspersoft.jfrog.io/jaspersoft/jr-ce-snapshots</url>
-		</snapshotRepository>
 	</distributionManagement>
 	<dependencies>
 		<dependency>

jasperreports/src/jasperreports_messages.properties

@@ -565,3 +565,5 @@ net.sf.jasperreports.exception.phantomjs.request.timed.out=The request to Phanto
 # deserialization class filter (CVE-2025-10492)
 net.sf.jasperreports.exception.deserialization.byte.count.limit.exceeded=Deserialization byte count limit of {0} has been exceeded.
 net.sf.jasperreports.exception.deserialization.class.not.visible=Class {0} is not visible to deserialization.
+# value deserialization class filter (CVE-2026-6009)
+net.sf.jasperreports.exception.value.deserialization.class.not.visible=Class {0} is not visible to value deserialization.

jasperreports/src/net/sf/jasperreports/engine/util/AbstractClassFilter.java

@@ -38,7 +38,7 @@
 /**
  * @author Lucian Chirita (lucianc@users.sourceforge.net)
  */
-public abstract class AbstractClassFilter implements ClassLoaderFilter
+public abstract class AbstractClassFilter implements DeserializationFilter
 {
 	protected abstract String getClassFilterEnabledPropertyName();
 

jasperreports/src/net/sf/jasperreports/engine/util/DeserializationFilter.java

@@ -0,0 +1,34 @@
+/*
+ * JasperReports - Free Java Reporting Library.
+ * Copyright (C) 2001 - 2025 Cloud Software Group, Inc. All rights reserved.
+ * http://www.jaspersoft.com
+ *
+ * Unless you have purchased a commercial license agreement from Jaspersoft,
+ * the following license terms apply:
+ *
+ * This program is part of JasperReports.
+ *
+ * JasperReports is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Lesser General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * JasperReports is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public License
+ * along with JasperReports. If not, see <http://www.gnu.org/licenses/>.
+ */
+package net.sf.jasperreports.engine.util;
+
+/**
+ * @author Lucian Chirita (lucianc@users.sourceforge.net)
+ */
+public interface DeserializationFilter extends ClassLoaderFilter
+{
+
+	boolean isFilteringEnabled();
+
+}

jasperreports/src/net/sf/jasperreports/engine/util/FilteredObjectInputStream.java

@@ -0,0 +1,101 @@
+/*
+ * JasperReports - Free Java Reporting Library.
+ * Copyright (C) 2001 - 2025 Cloud Software Group, Inc. All rights reserved.
+ * http://www.jaspersoft.com
+ *
+ * Unless you have purchased a commercial license agreement from Jaspersoft,
+ * the following license terms apply:
+ *
+ * This program is part of JasperReports.
+ *
+ * JasperReports is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Lesser General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * JasperReports is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public License
+ * along with JasperReports. If not, see <http://www.gnu.org/licenses/>.
+ */
+package net.sf.jasperreports.engine.util;
+
+import java.io.IOException;
+import java.io.InputStream;
+import java.io.ObjectInputStream;
+import java.io.ObjectStreamClass;
+
+import net.sf.jasperreports.engine.JRPropertiesUtil;
+import net.sf.jasperreports.engine.JasperReportsContext;
+
+/**
+ * A subclass of {@link ObjectInputStream} that filters the classes encountered
+ * in the stream against a configurable {@link DeserializationFilter}, and that
+ * optionally enforces the deserialization byte count limit.
+ *
+ * @author Teodor Danciu (teodord@users.sourceforge.net)
+ */
+public class FilteredObjectInputStream extends ObjectInputStream
+{
+	protected final JasperReportsContext jasperReportsContext;
+
+	private DeserializationFilter deserializationFilter;
+
+	/**
+	 * Creates an object input stream that reads data from the specified
+	 * {@link InputStream}.
+	 *
+	 * @param in the input stream to read data from
+	 * @throws IOException
+	 * @see ObjectInputStream#ObjectInputStream(InputStream)
+	 */
+	public FilteredObjectInputStream(JasperReportsContext jasperReportsContext, InputStream in,
+			DeserializationFilter deserializationFilter) throws IOException
+	{
+		super(wrapInputStream(jasperReportsContext, in));
+
+		this.jasperReportsContext = jasperReportsContext;
+		this.deserializationFilter = deserializationFilter;
+	}
+
+	private static InputStream wrapInputStream(JasperReportsContext jasperReportsContext, InputStream is)
+	{
+		String byteCountLimitProp = JRPropertiesUtil.getInstance(jasperReportsContext).getProperty(
+				ContextClassLoaderObjectInputStream.PROPERTY_BYTE_COUNT_LIMIT);
+		long byteCountLimit = (byteCountLimitProp == null || byteCountLimitProp.trim().length() == 0)
+				? 0L : Long.parseLong(byteCountLimitProp.trim());
+		return byteCountLimit == 0 ? is : new CountInputStream(is, byteCountLimit);
+	}
+
+	public JasperReportsContext getJasperReportsContext()
+	{
+		return jasperReportsContext;
+	}
+
+	@Override
+	protected Class<?> resolveClass(ObjectStreamClass desc) throws IOException,
+			ClassNotFoundException
+	{
+		if (deserializationFilter.isFilteringEnabled())
+		{
+			String className = desc.getName();
+			if (className.startsWith("["))
+			{
+				if (className.endsWith(";"))
+				{
+					className = className.substring(className.lastIndexOf("[L") + 2, className.length() - 1);
+				}
+				else
+				{
+					className = className.substring(className.lastIndexOf("[") + 1);
+				}
+			}
+			deserializationFilter.checkClassVisibility(className);
+		}
+
+		return super.resolveClass(desc);
+	}
+}

jasperreports/src/net/sf/jasperreports/engine/util/JRValueStringUtils.java

@@ -32,7 +32,9 @@
 import java.util.HashMap;
 import java.util.Map;
 
+import net.sf.jasperreports.engine.DefaultJasperReportsContext;
 import net.sf.jasperreports.engine.JRRuntimeException;
+import net.sf.jasperreports.engine.JasperReportsContext;
 
 import org.w3c.tools.codec.Base64Decoder;
 import org.w3c.tools.codec.Base64Encoder;
@@ -560,7 +562,9 @@ public Object deserialize(String data)
 				dec.process();
 
 				ByteArrayInputStream bytesIn = new ByteArrayInputStream(bytesOut.toByteArray());
-				ObjectInputStream objectIn = new ObjectInputStream(bytesIn);
+				JasperReportsContext context = DefaultJasperReportsContext.getInstance();
+				ObjectInputStream objectIn = new FilteredObjectInputStream(
+						context, bytesIn, new ValueClassFilter(context));
 				return objectIn.readObject();
 			}
 			catch (IOException e)

jasperreports/src/net/sf/jasperreports/engine/util/ValueClassFilter.java

@@ -0,0 +1,66 @@
+/*
+ * JasperReports - Free Java Reporting Library.
+ * Copyright (C) 2001 - 2025 Cloud Software Group, Inc. All rights reserved.
+ * http://www.jaspersoft.com
+ *
+ * Unless you have purchased a commercial license agreement from Jaspersoft,
+ * the following license terms apply:
+ *
+ * This program is part of JasperReports.
+ *
+ * JasperReports is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU Lesser General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * JasperReports is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
+ * GNU Lesser General Public License for more details.
+ *
+ * You should have received a copy of the GNU Lesser General Public License
+ * along with JasperReports. If not, see <http://www.gnu.org/licenses/>.
+ */
+package net.sf.jasperreports.engine.util;
+
+import net.sf.jasperreports.engine.JRPropertiesUtil;
+import net.sf.jasperreports.engine.JasperReportsContext;
+
+/**
+ * @author Lucian Chirita (lucianc@users.sourceforge.net)
+ */
+public class ValueClassFilter extends AbstractClassFilter
+{
+	public static final String PROPERTY_PREFIX_CLASS_WHITELIST =
+			JRPropertiesUtil.PROPERTY_PREFIX + "value.deserialization.class.whitelist.";
+
+	public static final String EXCEPTION_MESSAGE_KEY_CLASS_NOT_VISIBLE = "value.deserialization.class.not.visible";
+
+	public ValueClassFilter(JasperReportsContext jasperReportsContext)
+	{
+		super(jasperReportsContext);
+	}
+
+	@Override
+	protected String getClassFilterEnabledPropertyName()
+	{
+		return DeserializationClassFilter.PROPERTY_CLASS_FILTER_ENABLED;
+	}
+
+	@Override
+	protected String getClassWhitelistPropertyPrefix()
+	{
+		return PROPERTY_PREFIX_CLASS_WHITELIST;
+	}
+
+	@Override
+	protected String getClassNotVisibleExceptionMessageKey()
+	{
+		return EXCEPTION_MESSAGE_KEY_CLASS_NOT_VISIBLE;
+	}
+
+	@Override
+	protected void addHardcodedWhitelist(StandardClassWhitelist whitelist)
+	{
+	}
+}