Security context

Highlights

Deserialization of Untrusted Data: 2 prior fixes. Scrutinize any change in this area.

core/src/main/java/net/sf/jasperreports/engine/fill/VirtualizationObjectInputStream.java: most-fixed (1 issue). Treat as high-risk during review.

4 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

Deserialization of Untrusted Data: String-encoded values parsed by JRValueStringUtils previously used standard ObjectInputStream instances, allowing remote attackers to trigger arbitrary code execution via crafted serialized objects. Developers must ensure any string-to-object deserialization utilizes strict, custom-tailored class filters.

Deserialization of Untrusted Data: Virtualization streams used during report filling processes are highly vulnerable to object injection if they lack unified class filtering. Enforcing centralized class filters on virtualized object streams prevents exploitation during memory-swapping operations.

Deserialization: Combining multiple distinct operations under a single global class filter risks exposing sensitive operations (such as report expression compilation) to overly permissive class allowlists. Rigidly separating compilation whitelists from general-purpose deserialization whitelists is required to block bypasses.