/*
 * Copyright 2015 floragunn UG (haftungsbeschränkt)
 * 
 * Licensed under the Apache License, Version 2.0 (the "License");
 * you may not use this file except in compliance with the License.
 * You may obtain a copy of the License at
 * 
 *     http://www.apache.org/licenses/LICENSE-2.0
 *
 * Unless required by applicable law or agreed to in writing, software
 * distributed under the License is distributed on an "AS IS" BASIS,
 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
 * See the License for the specific language governing permissions and
 * limitations under the License.
 * 
 */

package com.floragunn.searchguard.support;

import java.io.ByteArrayInputStream;
import java.io.ByteArrayOutputStream;
import java.io.ObjectInputStream;
import java.io.ObjectOutputStream;
import java.io.Serializable;
import java.nio.charset.StandardCharsets;
import java.util.Objects;

import javax.xml.bind.DatatypeConverter;

import org.elasticsearch.ElasticsearchException;

import com.floragunn.searchguard.user.AuthCredentials;
import com.google.common.io.BaseEncoding;

public class Base64Helper {

    public static String encodeBasicHeader(final String username, final String password) {
        return new String(DatatypeConverter.printBase64Binary((username + ":" + Objects.requireNonNull(password)).getBytes(StandardCharsets.UTF_8)));
    }

    public static String serializeObject(final Serializable object) {

        if (object == null) {
            throw new IllegalArgumentException("object must not be null");
        }

        try {
            // final Cipher cipher = Cipher.getInstance("AES/CBC/PKCS5Padding");
            // cipher.init(Cipher.ENCRYPT_MODE, key);
            // final SealedObject sealedobject = new SealedObject(object,
            // cipher);
            final ByteArrayOutputStream bos = new ByteArrayOutputStream();
            final ObjectOutputStream out = new ObjectOutputStream(bos);
            out.writeObject(object);
            final byte[] bytes = bos.toByteArray();
            return BaseEncoding.base64().encode(bytes);
        } catch (final Exception e) {
            throw new ElasticsearchException(e.toString());
        }
    }

    public static Serializable deserializeObject(final String string) {

        if (string == null) {
            throw new IllegalArgumentException("string must not be null");
        }

        try {
            final byte[] userr = BaseEncoding.base64().decode(string);
            final ByteArrayInputStream bis = new ByteArrayInputStream(userr);
            final ObjectInputStream in = new ObjectInputStream(bis);
            // final SealedObject ud = (SealedObject) in.readObject();
            return (Serializable) in.readObject();
        } catch (final Exception e) {
            throw new ElasticsearchException(e.toString());
        }
    }
}

@@ -755,131 +755,434 @@
 .io.
-ObjectInputStream;%0Aimport java.io.ObjectOutputStream;%0Aimport java.io.Serializable;%0Aimport java.nio.charset.StandardCharsets
+IOException;%0Aimport java.io.InputStream;%0Aimport java.io.InvalidClassException;%0Aimport java.io.ObjectInputStream;%0Aimport java.io.ObjectOutputStream;%0Aimport java.io.ObjectStreamClass;%0Aimport java.io.Serializable;%0Aimport java.net.InetAddress;%0Aimport java.net.InetSocketAddress;%0Aimport java.net.SocketAddress;%0Aimport java.nio.charset.StandardCharsets;%0Aimport java.util.ArrayList;%0Aimport java.util.Collection;%0Aimport java.util.List
 ;%0Aim
@@ -1340,23 +1340,12 @@
 ser.
-AuthCredentials
+User
 ;%0Aim
@@ -1867,241 +1867,8 @@
 y %7B%0A
-            // final Cipher cipher = Cipher.getInstance(%22AES/CBC/PKCS5Padding%22);%0A            // cipher.init(Cipher.ENCRYPT_MODE, key);%0A            // final SealedObject sealedobject = new SealedObject(object,%0A            // cipher);%0A
     
@@ -2451,32 +2451,74 @@
 l%22);%0A        %7D%0A%0A
+        SafeObjectInputStream in = null;%0A%0A
         try %7B%0A  
@@ -2672,30 +2672,37 @@
             
-f
 in
-al 
+ = new Safe
 ObjectInputS
@@ -2710,113 +2710,932 @@
 ream
- in = new ObjectInputStream(bis);%0A            // final SealedObject ud = (SealedObject) in.readObject(
+(bis);%0A            return (Serializable) in.readObject();%0A        %7D catch (final Exception e) %7B%0A            throw new ElasticsearchException(e);%0A        %7D finally %7B%0A            if (in != null) %7B%0A                try %7B%0A                    in.close();%0A                %7D catch (IOException e) %7B%0A                    // ignore%0A                %7D%0A            %7D%0A        %7D%0A    %7D%0A    %0A    private final static class SafeObjectInputStream extends ObjectInputStream %7B%0A%0A        private static final List%3CString%3E SAFE_CLASSES = new ArrayList%3C%3E();%0A%0A        static %7B%0A            SAFE_CLASSES.add(%22com.floragunn.dlic.auth.ldap.LdapUser%22);%0A        %7D%0A%0A        public SafeObjectInputStream(InputStream in) throws IOException %7B%0A            super(in);%0A        %7D%0A%0A        @Override%0A        protected Class%3C?%3E resolveClass(ObjectStreamClass desc) throws IOException, ClassNotFoundException %7B%0A%0A            Class%3C?%3E clazz = super.resolveClass(desc
 );%0A
+%0A
     
@@ -3646,140 +3646,668 @@
     
-return (Serializable) in.readObject();%0A        %7D catch (final Exception e) %7B%0A            throw new ElasticsearchException(e.toString
+if (%0A                    clazz.isArray() %7C%7C%0A                    clazz.equals(String.class) %7C%7C%0A                    clazz.equals(SocketAddress.class) %7C%7C%0A                    clazz.equals(InetSocketAddress.class) %7C%7C%0A                    clazz.equals(InetAddress.class) %7C%7C%0A                    Number.class.isAssignableFrom(clazz) %7C%7C%0A                    Collection.class.isAssignableFrom(clazz) %7C%7C%0A                    clazz.equals(User.class) %7C%7C%0A                    SAFE_CLASSES.contains(clazz.getName())%0A               ) %7B%0A%0A                return clazz;%0A            %7D%0A%0A            throw new InvalidClassException(%22Unauthorized deserialization attempt%22, clazz.getName
 ());

Fix possible deserialization vulnerability (thats not exploitable out in the wild because all transport communication is SSL/TLS encrypted)