I receive the following messages in Lilith while deserializing events sent by ch.qos.logback.access.net.SocketAppender from within my logback-access-sandbox:

• Unauthorized deserialization attempt! org.springframework.web.servlet.FlashMap
• Unauthorized deserialization attempt! org.springframework.util.LinkedMultiValueMap

Those messages are created by my own WhitelistObjectInputStream whenever it sees an unexpected class. This is done for security reasons. More info is included in the source linked above.

The problem is that even if I whitelisted those classes, they aren't necessarily available on the receiving ends classpath. They are a webcontainer implementation detail that leak through the AccessEvent.

The messages show up since I switched my sandbox from manual servlet to spring-boot. I suspect that shouldCopyAttribute in ch.qos.logback.access.spi.AccessEvent is the culprit since it copies everything that is Serializable. Everything else in AccessEvent looks safe.

This should be fixed. I'm just not sure about how to fix it exactly... maybe doing toString() during copy?