Class loading issue with with Base64.stringToObject()

• Type: Bug
• Status: Closed
• Priority: Minor
• Resolution: Completed
• Affects Version/s: 5.1 EE SP4 (5.1.7), 5.2 EE SP2 (5.2.6)
• Fix Version/s: 5.1 EE SP5 (5.1.8), 5.2 EE SP3 (5.2.7)
• Component/s: None
• Labels:
  • 5.2_release_notes
• Environment: All

Base64.stringToObject(String s) can not used with a different class loader. Even if a different class loader is loaded before calling Base64.stringToObject(), the original class loader will sill be used.

Specifically, ClassLoaderObjectInputStream needs to use Class.forName() instead of ClassLoader.loadClass. The reason for this is because loadClass actually loads a new instance of the class into the JVM rather than fetch an already loaded class. This happens when doing cross-classloader loading which results in class in-equivalency.

To address this issue, a new method has been added to Base64:

stringToObject(String s, ClassLoader classLoader)

The new method will use the provided ClassLoader to convert the string to an object.