Add a defensive check to class resolution during deserialization

src/Platform_Core/org/lobobrowser/request/CacheInfo.java

@@ -27,6 +27,7 @@
 import java.io.IOException;
 import java.io.InputStream;
 import java.io.ObjectInputStream;
+import java.io.Serializable;
 import java.net.URL;
 import java.net.URLConnection;
 import java.util.logging.Level;
@@ -172,7 +173,7 @@ public Object getPersistentObject(final ClassLoader classLoader) {
 
       try (
           final InputStream in = new ByteArrayInputStream(content);
-          final ObjectInputStream oin = new ClassLoaderObjectInputStream(in, classLoader);) {
+          final ObjectInputStream oin = new ClassLoaderObjectInputStream(in, classLoader,Serializable.class);) {
         return oin.readObject();
       }
     } catch (final IOException ioe) {

src/Platform_Core/org/lobobrowser/store/ClassLoaderObjectInputStream.java

@@ -22,19 +22,44 @@
 
 import java.io.IOException;
 import java.io.InputStream;
+import java.io.InvalidClassException;
 import java.io.ObjectInputStream;
 import java.io.ObjectStreamClass;
 
 public class ClassLoaderObjectInputStream extends ObjectInputStream {
+
   private final ClassLoader classLoader;
+  private final Class<?> expectedClass;
+
+  public ClassLoaderObjectInputStream(
+          final InputStream in,
+          final ClassLoader classLoader) throws IOException {
+    this(in, classLoader, null);
+  }
 
-  public ClassLoaderObjectInputStream(final InputStream in, final ClassLoader classLoader) throws IOException {
+  public ClassLoaderObjectInputStream(
+          final InputStream in,
+          final ClassLoader classLoader,
+          final Class<?> expectedClass) throws IOException {
     super(in);
     this.classLoader = classLoader;
+    this.expectedClass = expectedClass;
   }
 
   @Override
-  protected Class<?> resolveClass(final ObjectStreamClass desc) throws IOException, ClassNotFoundException {
-    return Class.forName(desc.getName(), false, this.classLoader);
+  protected Class<?> resolveClass(final ObjectStreamClass desc)
+          throws IOException, ClassNotFoundException {
+
+    Class<?> resolved =
+        Class.forName(desc.getName(), false, this.classLoader);
+
+    if (expectedClass != null && !expectedClass.isAssignableFrom(resolved)) {
+      throw new InvalidClassException(
+          "Unexpected class during deserialization",
+          desc.getName()
+      );
+    }
+
+    return resolved;
   }
-}
+}

src/Platform_Core/org/lobobrowser/store/RestrictedStore.java

@@ -380,7 +380,7 @@ public Object retrieveObject(final String path, final ClassLoader classLoader) t
     final ManagedFile file = this.getManagedFile(path);
     try (
         final InputStream in = file.openInputStream();
-        final ObjectInputStream oin = new ClassLoaderObjectInputStream(in, classLoader)) {
+        final ObjectInputStream oin = new ClassLoaderObjectInputStream(in, classLoader, Serializable.class)) {
       return oin.readObject();
     } catch (final FileNotFoundException err) {
       return null;

src/Platform_Core/org/lobobrowser/store/StorageManager.java

@@ -243,7 +243,7 @@ public Serializable retrieveSettings(final String name, final ClassLoader classL
     try (
         final InputStream in = new FileInputStream(file);
         final BufferedInputStream bin = new BufferedInputStream(in);
-        final ObjectInputStream ois = new ClassLoaderObjectInputStream(bin, classLoader);) {
+        final ObjectInputStream ois = new ClassLoaderObjectInputStream(bin, classLoader, Serializable.class);) {
       return (Serializable) ois.readObject();
     } catch (final InvalidClassException ice) {
       ice.printStackTrace();