Added two more known vulnerable classes suggested by Mo.

Author: harawata

src/main/java/org/apache/ibatis/executor/loader/AbstractSerialStateHolder.java

@@ -133,12 +133,15 @@ protected abstract Object createDeserializationProxy(Object target, Map<String,
 
   private static class LookAheadObjectInputStream extends ObjectInputStream {
     private static final List<String> blacklist = Arrays.asList(
+        "org.apache.commons.beanutils.BeanComparator",
         "org.apache.commons.collections.functors.InvokerTransformer",
         "org.apache.commons.collections.functors.InstantiateTransformer",
         "org.apache.commons.collections4.functors.InvokerTransformer",
         "org.apache.commons.collections4.functors.InstantiateTransformer",
-        "org.codehaus.groovy.runtime.ConvertedClosure", "org.codehaus.groovy.runtime.MethodClosure",
+        "org.codehaus.groovy.runtime.ConvertedClosure",
+        "org.codehaus.groovy.runtime.MethodClosure",
         "org.springframework.beans.factory.ObjectFactory",
+        "org.springframework.transaction.jta.JtaTransactionManager",
         "com.sun.org.apache.xalan.internal.xsltc.trax.TemplatesImpl");
 
     public LookAheadObjectInputStream(InputStream in) throws IOException {