Improvements in SimpleDataBinder (#12606)

grails · Jul 12, 2022 · d3edcf2 · d3edcf2
1 parent 032dcad
commit d3edcf2
Showing 1 changed file with 10 additions and 5 deletions.
diff --git a/grails-databinding/src/main/groovy/grails/databinding/SimpleDataBinder.groovy b/grails-databinding/src/main/groovy/grails/databinding/SimpleDataBinder.groovy
@@ -34,6 +34,7 @@ import java.lang.reflect.Array
 import java.lang.reflect.Field
 import java.lang.reflect.Modifier
 import java.lang.reflect.ParameterizedType
+import java.security.ProtectionDomain
 
 /**
  * A data binder that will bind nested Maps to an object.
@@ -221,7 +222,7 @@ class SimpleDataBinder implements DataBinder {
                 def metaProperty = obj.metaClass.getMetaProperty propName
 
                 if (metaProperty) { // normal property
-                    if (isOkToBind(metaProperty.name, whiteList, blackList)) {
+                    if (isOkToBind(metaProperty, whiteList, blackList)) {
                         def val = source[key]
                         try {
                             def converter = getValueConverter(obj, metaProperty.name)
@@ -238,15 +239,15 @@ class SimpleDataBinder implements DataBinder {
                     def descriptor = getIndexedPropertyReferenceDescriptor propName
                     if (descriptor) { // indexed property
                         metaProperty = obj.metaClass.getMetaProperty descriptor.propertyName
-                        if (metaProperty && isOkToBind(metaProperty.name, whiteList, blackList)) {
+                        if (metaProperty && isOkToBind(metaProperty, whiteList, blackList)) {
                             def val = source.getPropertyValue key
                             processIndexedProperty obj, metaProperty, descriptor, val, source, listener, errors
                         }
                     } else if (propName.startsWith('_') && propName.length() > 1) { // boolean special handling
                         def restOfPropertyName = propName[1..-1]
                         if (!source.containsProperty(restOfPropertyName)) {
                             metaProperty = obj.metaClass.getMetaProperty restOfPropertyName
-                            if (metaProperty && isOkToBind(restOfPropertyName, whiteList, blackList)) {
+                            if (metaProperty && isOkToBind(metaProperty, whiteList, blackList)) {
                                 if ((Boolean == metaProperty.type || Boolean.TYPE == metaProperty.type)) {
                                     bindProperty obj, source, metaProperty, false, listener, errors
                                 }
@@ -258,8 +259,12 @@ class SimpleDataBinder implements DataBinder {
         }
     }
 
-    protected isOkToBind(String propName, List whiteList, List blackList) {
-        'metaClass' != propName && !blackList?.contains(propName) && (!whiteList || whiteList.contains(propName) || whiteList.find { it -> it?.toString()?.startsWith(propName + '.')})
+    protected boolean isOkToBind(String propName, List whiteList, List blackList) {
+        'class' != propName && 'classLoader' != propName && 'protectionDomain' != propName && 'metaClass' != propName && !blackList?.contains(propName) && (!whiteList || whiteList.contains(propName) || whiteList.find { it -> it?.toString()?.startsWith(propName + '.')})
+    }
+
+    protected boolean isOkToBind(MetaProperty property, List whitelist, List blacklist) {
+        isOkToBind(property.name, whitelist, blacklist) && (property.type != null && !(ClassLoader.class.isAssignableFrom(property.type) || ProtectionDomain.class.isAssignableFrom(property.type)))
     }
 
     protected IndexedPropertyReferenceDescriptor getIndexedPropertyReferenceDescriptor(propName) {