|
FlexDoc/Javadoc 2.0 Demo Java Doc |
The JVM-wide deserialization filter factory and the static JVM-wide filter can be configured from system properties during the initialization of the ObjectInputFilter.Config class.
If the Java virtual machine is started with the system property jdk.serialFilter, its value is used to configure the filter. If the system property is not defined, and the Security property jdk.serialFilter is defined then it is used to configure the filter. Otherwise, the filter is not configured during initialization and can be set with Config.setSerialFilter. Setting the jdk.serialFilter with System.setProperty does not set the filter. The syntax for the property value is the same as for the createFilter method.
If the Java virtual machine is started with the system property jdk.serialFilterFactory or the Security property of the same name, its value names the class to configure the JVM-wide deserialization filter factory. If the system property is not defined, and the Security property jdk.serialFilterFactory is defined then it is used to configure the filter factory. If it remains unset, the filter factory is a builtin filter factory compatible with previous versions.
The class must be public, must have a public zero-argument constructor, implement the BinaryOperator<ObjectInputFilter> interface, provide its implementation and be accessible via the application class loader. If the filter factory constructor is not invoked successfully, an ExceptionInInitializerError is thrown and subsequent use of the filter factory for deserialization fails with IllegalStateException. The filter factory configured using the system or security property during initialization can NOT be replaced with Config.setSerialFilterFactory. This ensures that a filter factory set on the command line is not overridden accidentally or intentionally by the application.
Setting the jdk.serialFilterFactory with System.setProperty does not set the filter factory. The syntax for the system property value and security property value is the fully qualified class name of the deserialization filter factory.
Method Summary |
||
static ObjectInputFilter |
createFilter(String pattern)
Returns an ObjectInputFilter from a string of patterns.
|
|
static ObjectInputFilter |
Returns the static JVM-wide deserialization filter or null if not configured.
|
|
static BinaryOperator<ObjectInputFilter> |
Returns the JVM-wide deserialization filter factory.
|
|
static void |
setSerialFilter(ObjectInputFilter filter)
Set the static JVM-wide filter if it has not already been configured or set.
|
|
static void |
Methods inherited from class java.lang.Object |
public static ObjectInputFilter getSerialFilter |
() |
public static void setSerialFilter |
(ObjectInputFilter filter) |
() |
public static void setSerialFilterFactory |
(BinaryOperator<ObjectInputFilter> filterFactory) |
The JVM-wide filter factory is invoked when an ObjectInputStream is constructed and when the stream-specific filter is set. The parameters are the current filter and a requested filter and it returns the filter to be used for the stream. If the current filter is non-null, the filter factory must return a non-null filter; this is to prevent unintentional disabling of filtering after it has been enabled. The factory determines the filter to be used for ObjectInputStream streams based on its inputs, any other filters, context, or state that is available. The factory may throw runtime exceptions to signal incorrect use or invalid parameters. See the filter models for examples of composition and delegation.
public static ObjectInputFilter createFilter |
(String pattern) |
Patterns are separated by ";" (semicolon). Whitespace is significant and is considered part of the pattern. If a pattern includes an equals assignment, "=" it sets a limit. If a limit appears more than once the last value is used.
Other patterns match or reject class or package name as returned from Class.getName() and if an optional module name is present class.getModule().getName(). Note that for arrays the element type is used in the pattern, not the array type.
The resulting filter performs the limit checks and then tries to match the class, if any. If any of the limits are exceeded, the filter returns Status.REJECTED. If the class is an array type, the class to be matched is the element type. Arrays of any number of dimensions are treated the same as the element type. For example, a pattern of "!example.Foo", rejects creation of any instance or array of example.Foo. The first pattern that matches, working from left to right, determines the Status.ALLOWED or Status.REJECTED result. If the limits are not exceeded and no pattern matches the class, the result is Status.UNDECIDED.
|
FlexDoc/Javadoc 2.0 Demo Java Doc |