package org.springframework.security.oauth2.common.util;

import java.io.*;

public class SerializationUtils {

	public static byte[] serialize(Object state) {
		ObjectOutputStream oos = null;
		try {
			ByteArrayOutputStream bos = new ByteArrayOutputStream(512);
			oos = new ObjectOutputStream(bos);
			oos.writeObject(state);
			oos.flush();
			return bos.toByteArray();
		}
		catch (IOException e) {
			throw new IllegalArgumentException(e);
		}
		finally {
			if (oos != null) {
				try {
					oos.close();
				}
				catch (IOException e) {
					// eat it
				}
			}
		}
	}

	public static <T> T deserialize(byte[] byteArray) {
		ObjectInputStream oip = null;
		try {
			oip = new ObjectInputStream(new ByteArrayInputStream(byteArray));
			@SuppressWarnings("unchecked")
			T result = (T) oip.readObject();
			return result;
		}
		catch (IOException e) {
			throw new IllegalArgumentException(e);
		}
		catch (ClassNotFoundException e) {
			throw new IllegalArgumentException(e);
		}
		finally {
			if (oip != null) {
				try {
					oip.close();
				}
				catch (IOException e) {
					// eat it
				}
			}
		}
	}

}

@@ -70,9 +70,227 @@
 .io.
-*
+ByteArrayInputStream;%0Aimport java.io.ByteArrayOutputStream;%0Aimport java.io.IOException;%0Aimport java.io.ObjectInputStream;%0Aimport java.io.ObjectOutputStream;%0A%0Aimport org.springframework.core.ConfigurableObjectInputStream
 ;%0A%0Ap
@@ -893,24 +893,36 @@
 %09%09oip = new 
+Configurable
 ObjectInputS
@@ -962,16 +962,69 @@
 teArray)
+,%0A%09%09%09%09%09Thread.currentThread().getContextClassLoader()
 );%0A%09%09%09@S

Use thread context class loader to load classes during deserialization