Update Java_Gadget_Injector.java

[novysodope]

Not using readObject to read messages,prevent exploitation of deserialization vulnerabilities

[vmwclabot]

@novysodope, you must sign every commit in this pull request acknowledging our Developer Certificate of Origin before your changes are merged. This can be done by adding Signed-off-by: John Doe <[email protected]> to the last line of each Git commit message. The e-mail address used to sign must match the e-mail address of the Git author. Click here to view the Developer Certificate of Origin agreement.

• Commit 271b739 has a no-reply/unreachable author email address: [email protected]

[novysodope]

InputStream.read was used in the submitted branch, which may affect functionality. It is recommended to rewrite the resolveClass method to restrict deserialization classes in a whitelist manner:

@Override
protected Class<?> resolveClass(ObjectStreamClass desc) throws IOException, ClassNotFoundException {
    String className = desc.getName();

    // Check if it is the expected class name
    if (!allowedClassName.equals(className)) {
        throw new SecurityException("Class not allowed: " + className);
    }