tomdesair / tus-java-server / 40195237696

95%

Build Type

push

github

Committed by web-flow

Commit Message

Fix insecure deserialization via ValidatingObjectInputStream strict class filtering (#148)

Replace package-level wildcards in ValidatingObjectInputStream with an explicit allow-list of allowed classes to eliminate insecure object deserialization vectors.

Co-authored-by: google-labs-jules[bot] <161369871+google-labs-jules[bot]@users.noreply.github.com>
Co-authored-by: tomdesair <14034630+tomdesair@users.noreply.github.com>

Coverage Stats

3332 of 3756 branches covered (88.71%)

Branch coverage included in aggregate %.

7 of 7 new or added lines in 1 file covered. (100.0%)

1 existing line in 1 file now uncovered.

7061 of 7197 relevant lines covered (98.11%)

6.39 hits per line