wrap ObjectOutputStream with strict version.

Author: littleaj

core/src/main/java/com/microsoft/applicationinsights/internal/channel/common/TransmissionFileSystemOutput.java

@@ -23,14 +23,15 @@
 
 import java.io.File;
 import java.io.InputStream;
+import java.io.InvalidClassException;
 import java.io.ObjectInput;
 import java.io.FileInputStream;
 import java.io.BufferedInputStream;
 import java.io.ObjectInputStream;
 import java.io.FileNotFoundException;
 import java.io.IOException;
 import java.io.FileOutputStream;
-import java.io.OutputStream;
+import java.io.ObjectStreamClass;
 import java.io.BufferedOutputStream;
 import java.io.ObjectOutput;
 import java.io.ObjectOutputStream;
@@ -244,7 +245,7 @@ private Optional<Transmission> loadTransmission(File file) {
         if (file == null) {
             return Optional.absent();
         }
-        try (ObjectInput input = new ObjectInputStream(new BufferedInputStream(new FileInputStream(file)))) {
+        try (ObjectInput input = new SafeObjectInputStream(new BufferedInputStream(new FileInputStream(file)))) {
             transmission = (Transmission)input.readObject();
         } catch (FileNotFoundException e) {
             InternalLogger.INSTANCE.error("Failed to load transmission, file not found, exception: %s", e.toString());
@@ -257,6 +258,21 @@ private Optional<Transmission> loadTransmission(File file) {
         return Optional.fromNullable(transmission);
     }
 
+    private final static class SafeObjectInputStream extends ObjectInputStream {
+
+        public SafeObjectInputStream(InputStream in) throws IOException {
+            super(in);
+        }
+
+        protected Class<?> resolveClass(ObjectStreamClass desc) throws IOException, ClassNotFoundException {
+            if (!desc.getName().equals(Transmission.class.getName()) && !desc.getName().equals(byte[].class.getName())) {
+                throw new InvalidClassException("Cannot deserialize "+desc.getName());
+            } else {
+                return super.resolveClass(desc);
+            }
+        }
+    }
+
     private boolean renameToPermanentName(File tempTransmissionFile) {
         File transmissionFile = new File(folder, FilenameUtils.getBaseName(tempTransmissionFile.getName()) + TRANSMISSION_FILE_EXTENSION);
         try {