[#2831] - Add optional JEP-290 ObjectInputFilter support to DefaultSerializer

Add an optional ObjectInputFilter (getObjectInputFilter/setObjectInputFilter,
null by default) to DefaultSerializer, applied in deserialize() when set, and
pre-configure AbstractRememberMeManager's default serializer with a conservative
resource-limit-only filter (maxdepth=30;maxarray=100000;maxrefs=10000;maxbytes=10000000).
Document the one-line class-based allow-list override on getSerializer(). The null
default means no behavior change for existing callers.

Author: Nexory

core/src/main/java/org/apache/shiro/mgt/AbstractRememberMeManager.java

@@ -40,6 +40,7 @@
 
 import java.io.IOException;
 import java.io.InputStream;
+import java.io.ObjectInputFilter;
 import java.io.ObjectInputStream;
 import java.io.Serial;
 import java.io.Serializable;
@@ -91,6 +92,38 @@ protected ClassLoader doGetClassLoader() {
         }
     };
 
+    /**
+     * Default <a href="https://openjdk.org/jeps/290">JEP-290</a> filter pattern applied to the
+     * {@link #getSerializer() serializer}'s {@code ObjectInputStream} when deserializing the RememberMe cookie
+     * payload, an untrusted, client-supplied value (see {@link #getRememberedPrincipals(SubjectContext)}).
+     * <p/>
+     * This default is deliberately a <em>resource-limit-only</em> filter: it bounds the object graph depth,
+     * array size, back-reference count, and total stream size that {@code readObject()} will process, but it
+     * does not restrict <em>which</em> classes may be deserialized. It is intended as defense-in-depth against
+     * oversized or deeply nested (denial-of-service shaped) payloads reaching this deserialization sink. It is
+     * <em>not</em> protection against remote-code-execution gadget chains: typical serialization gadget chains
+     * (for example the Apache Commons Collections family) are shallow and small, so they stay well within these
+     * limits and are <em>not</em> rejected by them. Stopping such chains requires a class-based allow-list,
+     * which cannot be a safe default here because principal types are entirely application-defined (custom
+     * {@code Serializable} principal classes are common) and a default allow-list would break existing
+     * deployments. Applications that need that stronger, class-based defense (for example to reduce the blast
+     * radius of a leaked or static cipher key, the classic Shiro-550 / CVE-2016-4437 scenario) can configure
+     * one in a single line; see {@link #getSerializer()}. The depth limit is set generously (well above the
+     * depth of realistic principal object graphs) so that well-formed principal data is not rejected.
+     *
+     * @since 3.1
+     */
+    private static final String DEFAULT_OBJECT_INPUT_FILTER_PATTERN =
+            "maxdepth=30;maxarray=100000;maxrefs=10000;maxbytes=10000000";
+
+    /**
+     * Default {@link ObjectInputFilter} instance built from {@link #DEFAULT_OBJECT_INPUT_FILTER_PATTERN}.
+     *
+     * @since 3.1
+     */
+    private static final ObjectInputFilter DEFAULT_OBJECT_INPUT_FILTER =
+            ObjectInputFilter.Config.createFilter(DEFAULT_OBJECT_INPUT_FILTER_PATTERN);
+
     /**
      * Serializer to use for converting PrincipalCollection instances to/from byte arrays
      */
@@ -119,9 +152,17 @@ protected ObjectInputStream createObjectInputStream(InputStream inputStream) thr
     /**
      * Default constructor that initializes a {@link DefaultSerializer} as the {@link #getSerializer() serializer} and
      * an {@link AesCipherService} as the {@link #getCipherService() cipherService}.
+     * <p/>
+     * As defense-in-depth against the {@link #getRememberedPrincipals(SubjectContext)} deserialization path
+     * operating on untrusted, client-supplied input, the default serializer is also pre-configured with the
+     * {@link #DEFAULT_OBJECT_INPUT_FILTER_PATTERN conservative resource-limit ObjectInputFilter} described above.
      */
+    @SuppressWarnings("unchecked")
     public AbstractRememberMeManager() {
         setCipherKey(((AesCipherService) cipherService).generateNewKey().getEncoded());
+        if (serializer instanceof DefaultSerializer) {
+            ((DefaultSerializer<RememberedIdentity>) serializer).setObjectInputFilter(DEFAULT_OBJECT_INPUT_FILTER);
+        }
     }
 
     /**
@@ -140,7 +181,16 @@ public AbstractRememberMeManager(Supplier<byte[]> keySupplier) {
      * persistent remember me storage.
      * <p/>
      * Unless overridden by the {@link #setSerializer} method, the default instance is a
-     * {@link org.apache.shiro.lang.io.DefaultSerializer}.
+     * {@link org.apache.shiro.lang.io.DefaultSerializer} pre-configured with the conservative resource-limit
+     * <a href="https://openjdk.org/jeps/290">JEP-290</a> {@link ObjectInputFilter} described at
+     * {@link #DEFAULT_OBJECT_INPUT_FILTER_PATTERN}. Applications that know the exact set of principal classes
+     * they store (for example, a single {@code SimplePrincipalCollection} of {@code String}s) are encouraged to
+     * replace it with a stricter, class-based allow-list, built with
+     * {@link ObjectInputFilter.Config#createFilter(String)}:
+     * <pre>
+     * ((DefaultSerializer&lt;?&gt;) rememberMeManager.getSerializer())
+     *         .setObjectInputFilter(ObjectInputFilter.Config.createFilter("com.example.MyPrincipal;!*"));
+     * </pre>
      *
      * @return the {@code Serializer} used to serialize and deserialize {@link PrincipalCollection} instances for
      * persistent remember me storage.

core/src/test/java/org/apache/shiro/mgt/AbstractRememberMeManagerObjectInputFilterTest.java

@@ -0,0 +1,207 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied.  See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+package org.apache.shiro.mgt;
+
+import org.apache.shiro.lang.io.DefaultSerializer;
+import org.apache.shiro.lang.io.Serializer;
+import org.apache.shiro.subject.PrincipalCollection;
+import org.apache.shiro.subject.SimplePrincipalCollection;
+import org.apache.shiro.subject.Subject;
+import org.apache.shiro.subject.SubjectContext;
+import org.apache.shiro.subject.support.DefaultSubjectContext;
+import org.junit.jupiter.api.Test;
+
+import java.io.ByteArrayOutputStream;
+import java.io.IOException;
+import java.io.InvalidClassException;
+import java.io.ObjectInputFilter;
+import java.io.ObjectOutputStream;
+import java.io.Serializable;
+import java.util.ArrayList;
+import java.util.List;
+
+import static org.assertj.core.api.Assertions.assertThat;
+import static org.assertj.core.api.Assertions.assertThatThrownBy;
+
+/**
+ * Test cases proving {@link AbstractRememberMeManager}'s RememberMe cookie deserialization path is
+ * protected by a <a href="https://openjdk.org/jeps/290">JEP-290</a> {@link ObjectInputFilter} by default,
+ * without breaking legitimate {@link PrincipalCollection} round-tripping.
+ */
+class AbstractRememberMeManagerObjectInputFilterTest {
+
+    /** Deeper than the default filter's {@code maxdepth=30}, to trigger a resource-limit rejection. */
+    private static final int DEEP_CHAIN_LENGTH = 60;
+
+    @Test
+    void testLegitimatePrincipalsRoundTripUnderDefaultFilter() {
+        InMemoryRememberMeManager rmm = new InMemoryRememberMeManager();
+        PrincipalCollection principals = new SimplePrincipalCollection("joecool", "myRealm");
+
+        rmm.rememberIdentity(null, principals);
+        PrincipalCollection remembered = rmm.getRememberedPrincipals(new DefaultSubjectContext());
+
+        assertThat(remembered).isNotNull();
+        assertThat(remembered.getPrimaryPrincipal()).isEqualTo("joecool");
+    }
+
+    @Test
+    void testDefaultFilterRejectsOversizedPayloadBeforeFullConstruction() {
+        // The default filter (see AbstractRememberMeManager.DEFAULT_OBJECT_INPUT_FILTER_PATTERN) bounds the
+        // object graph depth/array size/reference count/byte count of the deserialized payload. This is
+        // denial-of-service-shaped-payload hardening: it does not restrict classes and does not stop RCE
+        // gadget chains (which are shallow and small). Feed an oversized/deeply nested payload that exceeds
+        // maxdepth, encrypted the way a real RememberMe cookie is, and confirm getRememberedPrincipals() fails
+        // closed with a JEP-290 filter rejection (InvalidClassException) before the graph is materialized. The
+        // InvalidClassException cause is the discriminating assertion: without the filter this same payload
+        // deserializes fully and fails only later with an unrelated ClassCastException, so asserting the cause
+        // is what proves the filter itself fired.
+        InMemoryRememberMeManager rmm = new InMemoryRememberMeManager();
+
+        List<Object> deepChain = new ArrayList<>();
+        List<Object> cursor = deepChain;
+        for (int i = 0; i < DEEP_CHAIN_LENGTH; i++) {
+            List<Object> next = new ArrayList<>();
+            cursor.add(next);
+            cursor = next;
+        }
+
+        byte[] serialized = plainJdkSerialize(deepChain);
+        byte[] encrypted = rmm.encryptForTest(serialized);
+        rmm.injectRawSerializedIdentity(encrypted);
+
+        assertThatThrownBy(() -> rmm.getRememberedPrincipals(new DefaultSubjectContext()))
+                .isInstanceOf(RuntimeException.class)
+                .hasCauseInstanceOf(InvalidClassException.class);
+        // onRememberedPrincipalFailure must have run its "forget" cleanup path.
+        assertThat(rmm.forgetCount).isEqualTo(1);
+    }
+
+    @Test
+    @SuppressWarnings("unchecked")
+    void testCustomStricterAllowListFilterCanBeConfigured() {
+        // Documented override path (see AbstractRememberMeManager#getSerializer javadoc): cast the default
+        // DefaultSerializer and replace its filter with a strict class allow-list. Only SimplePrincipalCollection,
+        // AbstractRememberMeManager.RememberedIdentity, and JDK collection/primitive/java.time plumbing are let
+        // through. Note: java.time types (e.g. Instant) don't serialize themselves directly - they writeReplace()
+        // to an internal java.time serialization proxy class, which is what actually appears in the stream.
+        InMemoryRememberMeManager rmm = new InMemoryRememberMeManager();
+        ((DefaultSerializer<AbstractRememberMeManager.RememberedIdentity>) rmm.getSerializer())
+                .setObjectInputFilter(ObjectInputFilter.Config.createFilter(
+                        "org.apache.shiro.subject.SimplePrincipalCollection;"
+                                + "org.apache.shiro.mgt.AbstractRememberMeManager$RememberedIdentity;"
+                                + "java.time.*;java.util.*;java.lang.*;!*"));
+
+        PrincipalCollection principals = new SimplePrincipalCollection("joecool", "myRealm");
+        rmm.rememberIdentity(null, principals);
+        PrincipalCollection remembered = rmm.getRememberedPrincipals(new DefaultSubjectContext());
+        assertThat(remembered.getPrimaryPrincipal()).isEqualTo("joecool");
+
+        // A disallowed class must now be rejected outright (not merely resource-limited).
+        byte[] disallowed = plainJdkSerialize(new NotAllowlisted());
+        rmm.injectRawSerializedIdentity(rmm.encryptForTest(disallowed));
+
+        assertThatThrownBy(() -> rmm.getRememberedPrincipals(new DefaultSubjectContext()))
+                .isInstanceOf(RuntimeException.class);
+    }
+
+    @Test
+    void testCustomSerializerIsUnaffectedByDefaultFilterMachinery() {
+        // A caller-supplied Serializer implementation (not a DefaultSerializer) must keep working exactly as
+        // before this feature existed - AbstractRememberMeManager only touches the filter on its own default
+        // DefaultSerializer instance, never on a replaced Serializer.
+        InMemoryRememberMeManager rmm = new InMemoryRememberMeManager();
+        rmm.setSerializer(new Serializer<AbstractRememberMeManager.RememberedIdentity>() {
+            @Override
+            public byte[] serialize(AbstractRememberMeManager.RememberedIdentity o) {
+                return plainJdkSerialize(o);
+            }
+
+            @Override
+            @SuppressWarnings("unchecked")
+            public AbstractRememberMeManager.RememberedIdentity deserialize(byte[] serialized) {
+                try (var ois = new java.io.ObjectInputStream(new java.io.ByteArrayInputStream(serialized))) {
+                    return (AbstractRememberMeManager.RememberedIdentity) ois.readObject();
+                } catch (IOException | ClassNotFoundException e) {
+                    throw new RuntimeException(e);
+                }
+            }
+        });
+
+        PrincipalCollection principals = new SimplePrincipalCollection("joecool", "myRealm");
+        rmm.rememberIdentity(null, principals);
+        PrincipalCollection remembered = rmm.getRememberedPrincipals(new DefaultSubjectContext());
+
+        assertThat(remembered.getPrimaryPrincipal()).isEqualTo("joecool");
+    }
+
+    private static byte[] plainJdkSerialize(Object o) {
+        try {
+            ByteArrayOutputStream baos = new ByteArrayOutputStream();
+            try (ObjectOutputStream oos = new ObjectOutputStream(baos)) {
+                oos.writeObject(o);
+            }
+            return baos.toByteArray();
+        } catch (IOException e) {
+            throw new RuntimeException(e);
+        }
+    }
+
+    public static class NotAllowlisted implements Serializable {
+        private static final long serialVersionUID = 1L;
+    }
+
+    /**
+     * Minimal in-memory RememberMeManager test double: stores the "persisted" (encrypted+serialized) bytes
+     * in a field instead of a cookie, and tracks how many times identity was forgotten.
+     */
+    private static final class InMemoryRememberMeManager extends AbstractRememberMeManager {
+        private byte[] stored;
+        private int forgetCount;
+
+        @Override
+        protected void forgetIdentity(Subject subject) {
+            stored = null;
+            forgetCount++;
+        }
+
+        public void forgetIdentity(SubjectContext subjectContext) {
+            stored = null;
+            forgetCount++;
+        }
+
+        @Override
+        protected void rememberSerializedIdentity(Subject subject, byte[] serialized) {
+            this.stored = serialized;
+        }
+
+        @Override
+        protected byte[] getRememberedSerializedIdentity(SubjectContext subjectContext) {
+            return stored;
+        }
+
+        void injectRawSerializedIdentity(byte[] raw) {
+            this.stored = raw;
+        }
+
+        byte[] encryptForTest(byte[] plain) {
+            return encrypt(plain);
+        }
+    }
+}

lang/src/main/java/org/apache/shiro/lang/io/DefaultSerializer.java

@@ -24,6 +24,7 @@
 import java.io.ByteArrayOutputStream;
 import java.io.IOException;
 import java.io.InputStream;
+import java.io.ObjectInputFilter;
 import java.io.ObjectInputStream;
 import java.io.ObjectOutputStream;
 
@@ -34,6 +35,18 @@
  * @since 0.9
  */
 public class DefaultSerializer<T> implements Serializer<T> {
+
+    /**
+     * Optional <a href="https://openjdk.org/jeps/290">JEP-290</a> filter applied to the
+     * {@link ObjectInputStream} used by {@link #deserialize(byte[])}.
+     * <p/>
+     * {@code null} by default, meaning no filter is applied and behavior is unchanged from prior releases -
+     * existing callers of this class are not affected unless they opt in via {@link #setObjectInputFilter}.
+     *
+     * @since 3.1
+     */
+    private ObjectInputFilter objectInputFilter;
+
     /**
      * This implementation serializes the Object by using an {@link ObjectOutputStream} backed by a
      * {@link ByteArrayOutputStream}.  The {@code ByteArrayOutputStream}'s backing byte array is returned.
@@ -81,6 +94,9 @@ public T deserialize(byte[] serialized) throws SerializationException {
         BufferedInputStream bis = new BufferedInputStream(bais);
         try {
             ObjectInputStream ois = createObjectInputStream(bis);
+            if (objectInputFilter != null) {
+                ois.setObjectInputFilter(objectInputFilter);
+            }
             @SuppressWarnings({"unchecked"})
             T deserialized = (T) ois.readObject();
             ois.close();
@@ -94,4 +110,38 @@ public T deserialize(byte[] serialized) throws SerializationException {
     protected ObjectInputStream createObjectInputStream(InputStream inputStream) throws IOException {
         return new ClassResolvingObjectInputStream(inputStream);
     }
+
+    /**
+     * Returns the <a href="https://openjdk.org/jeps/290">JEP-290</a> {@link ObjectInputFilter} applied to the
+     * {@link ObjectInputStream} used by {@link #deserialize(byte[])}, or {@code null} if none is configured.
+     *
+     * @return the configured {@code ObjectInputFilter}, or {@code null} if none is configured.
+     * @since 3.1
+     */
+    public ObjectInputFilter getObjectInputFilter() {
+        return objectInputFilter;
+    }
+
+    /**
+     * Sets a <a href="https://openjdk.org/jeps/290">JEP-290</a> {@link ObjectInputFilter} to apply to the
+     * {@link ObjectInputStream} used by {@link #deserialize(byte[])}, providing defense-in-depth against
+     * malicious serialized payloads (for example, a class or resource-limit allow-list) in addition to any
+     * validation the caller performs on the deserialized result.
+     * <p/>
+     * The filter is consulted by the JVM for every class resolved while reading the stream, before that
+     * class is instantiated - a rejecting filter causes {@code deserialize} to fail (wrapped in a
+     * {@link SerializationException}) instead of constructing the disallowed object. See
+     * {@link ObjectInputFilter.Config#createFilter(String)} for a convenient way to build a pattern-based
+     * filter combining class allow/deny lists with depth, reference, and byte-count limits.
+     * <p/>
+     * The default is {@code null} (no filter), matching this class's behavior prior to this option being
+     * introduced. Callers handling untrusted input, such as {@link org.apache.shiro.mgt.AbstractRememberMeManager
+     * AbstractRememberMeManager}'s RememberMe cookie deserialization, are encouraged to configure one.
+     *
+     * @param objectInputFilter the filter to apply, or {@code null} to disable filtering (the default).
+     * @since 3.1
+     */
+    public void setObjectInputFilter(ObjectInputFilter objectInputFilter) {
+        this.objectInputFilter = objectInputFilter;
+    }
 }