Author: mmusaji Date: 2013-10-01 06:31:15 -0400 (Tue, 01 Oct 2013) New Revision: 2271 Modified: branches/JBOSSWEB_7_2_0_FINAL_BZ-1013996/src/main/java/org/apache/tomcat/util/http/fileupload/FileItem.java branches/JBOSSWEB_7_2_0_FINAL_BZ-1013996/src/main/java/org/apache/tomcat/util/http/fileupload/disk/DiskFileItem.java Log: Merged BZ-968578 and BZ-974813 (CVE-2013-2185) Modified: branches/JBOSSWEB_7_2_0_FINAL_BZ-1013996/src/main/java/org/apache/tomcat/util/http/fileupload/FileItem.java =================================================================== --- branches/JBOSSWEB_7_2_0_FINAL_BZ-1013996/src/main/java/org/apache/tomcat/util/http/fileupload/FileItem.java 2013-10-01 09:56:17 UTC (rev 2270) +++ branches/JBOSSWEB_7_2_0_FINAL_BZ-1013996/src/main/java/org/apache/tomcat/util/http/fileupload/FileItem.java 2013-10-01 10:31:15 UTC (rev 2271) @@ -20,7 +20,6 @@ import java.io.IOException; import java.io.InputStream; import java.io.OutputStream; -import java.io.Serializable; import java.io.UnsupportedEncodingException; /** @@ -50,7 +49,7 @@ * * @version $Id: FileItem.java 1533 2010-08-18 10:01:08Z remy.maucherat(a)jboss.com $ */ -public interface FileItem extends Serializable { +public interface FileItem extends FileItemHeadersSupport { // ------------------------------- Methods from javax.activation.DataSource Modified: branches/JBOSSWEB_7_2_0_FINAL_BZ-1013996/src/main/java/org/apache/tomcat/util/http/fileupload/disk/DiskFileItem.java =================================================================== --- branches/JBOSSWEB_7_2_0_FINAL_BZ-1013996/src/main/java/org/apache/tomcat/util/http/fileupload/disk/DiskFileItem.java 2013-10-01 09:56:17 UTC (rev 2270) +++ branches/JBOSSWEB_7_2_0_FINAL_BZ-1013996/src/main/java/org/apache/tomcat/util/http/fileupload/disk/DiskFileItem.java 2013-10-01 10:31:15 UTC (rev 2271) @@ -26,8 +26,6 @@ import java.io.FileOutputStream; import java.io.IOException; import java.io.InputStream; -import java.io.ObjectInputStream; -import java.io.ObjectOutputStream; import java.io.OutputStream; import java.io.UnsupportedEncodingException; import java.util.Map; @@ -89,12 +87,6 @@ // ----------------------------------------------------- Manifest constants /** - * The UID to use when serializing this instance. - */ - private static final long serialVersionUID = 2237570099615271025L; - - - /** * Default content charset to be used when no explicit charset * parameter is provided by the sender. Media subtypes of the * "text" type are defined to have a default charset value of @@ -180,11 +172,6 @@ private transient File tempFile; /** - * File to allow for serialization of the content of this item. - */ - private File dfosFile; - - /** * The file items headers. */ private FileItemHeaders headers; @@ -658,9 +645,6 @@ return id; } - - - /** * Returns a string representation of this object. * @@ -679,58 +663,7 @@ + this.getFieldName(); } - - // -------------------------------------------------- Serialization methods - - /** - * Writes the state of this object during serialization. - * - * @param out The stream to which the state should be written. - * - * @throws IOException if an error occurs. - */ - private void writeObject(ObjectOutputStream out) throws IOException { - // Read the data - if (dfos.isInMemory()) { - cachedContent = get(); - } else { - cachedContent = null; - dfosFile = dfos.getFile(); - } - - // write out values - out.defaultWriteObject(); - } - - /** - * Reads the state of this object during deserialization. - * - * @param in The stream from which the state should be read. - * - * @throws IOException if an error occurs. - * @throws ClassNotFoundException if class cannot be found. - */ - private void readObject(ObjectInputStream in) - throws IOException, ClassNotFoundException { - // read values - in.defaultReadObject(); - - OutputStream output = getOutputStream(); - if (cachedContent != null) { - output.write(cachedContent); - } else { - FileInputStream input = new FileInputStream(dfosFile); - IOUtils.copy(input, output); - dfosFile.delete(); - dfosFile = null; - } - output.close(); - - cachedContent = null; - } - - /** * Returns the file item headers. * @return The file items headers. */