package com.orangefunction.tomcat.redissessions;

import org.apache.catalina.util.CustomObjectInputStream;

import javax.servlet.http.HttpSession;

import java.util.Enumeration;
import java.util.HashMap;
import java.io.*;
import java.security.MessageDigest;
import java.security.NoSuchAlgorithmException;

import org.apache.juli.logging.Log;
import org.apache.juli.logging.LogFactory;

public class JavaSerializer implements Serializer {
  private ClassLoader loader;

  private final Log log = LogFactory.getLog(JavaSerializer.class);

  @Override
  public void setClassLoader(ClassLoader loader) {
    this.loader = loader;
  }

  public byte[] attributesHashFrom(RedisSession session) throws IOException {
    HashMap<String,Object> attributes = new HashMap<String,Object>();
    for (Enumeration<String> enumerator = session.getAttributeNames(); enumerator.hasMoreElements();) {
      String key = enumerator.nextElement();
      attributes.put(key, session.getAttribute(key));
    }

    ByteArrayOutputStream bos = new ByteArrayOutputStream();
    try (ObjectOutputStream oos = new ObjectOutputStream(new BufferedOutputStream(bos))) {
      oos.writeUnshared(attributes);
    }

    MessageDigest digester = null;
    try {
      digester = MessageDigest.getInstance("MD5");
    } catch (NoSuchAlgorithmException e) {
      log.error("Unable to get MessageDigest instance for MD5");
    }
    return digester.digest(bos.toByteArray());
  }

  @Override
  public byte[] serializeFrom(RedisSession session, SessionSerializationMetadata metadata) throws IOException {
    ByteArrayOutputStream bos = new ByteArrayOutputStream();
    try (ObjectOutputStream oos = new ObjectOutputStream(new BufferedOutputStream(bos))) {
      oos.writeObject(metadata);
      session.writeObjectData(oos);
    }

    return bos.toByteArray();
  }

  @Override
  public void deserializeInto(byte[] data, RedisSession session, SessionSerializationMetadata metadata) throws IOException, ClassNotFoundException {
    try(
        BufferedInputStream bis = new BufferedInputStream(new ByteArrayInputStream(data));
        ObjectInputStream ois = new CustomObjectInputStream(bis, loader);
    ) {
      SessionSerializationMetadata serializedMetadata = (SessionSerializationMetadata)ois.readObject();
      metadata.copyFieldsFrom(serializedMetadata);
      session.readObjectData(ois);
    }
  }
}

@@ -978,24 +978,70 @@
 y));%0A    %7D%0A%0A
+    byte%5B%5D serialized = null;%0A%0A    try (%0A     
     ByteArra
@@ -1085,37 +1085,37 @@
 utStream();%0A    
-try (
+     
 ObjectOutputStre
@@ -1168,32 +1168,38 @@
 tputStream(bos))
+;%0A    
 ) %7B%0A      oos.wr
@@ -1222,16 +1222,55 @@
 ibutes);
+%0A%0A      serialized = bos.toByteArray();
 %0A    %7D%0A%0A
@@ -1506,33 +1506,26 @@
 .digest(
-bos.toByteArray()
+serialized
 );%0A  %7D%0A%0A
@@ -1644,24 +1644,70 @@
 Exception %7B%0A
+    byte%5B%5D serialized = null;%0A%0A    try (%0A     
     ByteArra
@@ -1759,21 +1759,21 @@
 ();%0A    
-try (
+     
 ObjectOu
@@ -1842,16 +1842,22 @@
 am(bos))
+;%0A    
 ) %7B%0A    
@@ -1925,25 +1925,27 @@
 s);%0A
+%0A
     
-%7D%0A%0A    return
+  serialized =
  bos
@@ -1960,16 +1960,46 @@
 rray();%0A
+    %7D%0A%0A    return serialized;%0A
   %7D%0A%0A  @

Fix possible resource leak in serialization.