Package com.dna.jopt.io.shared

Class DeserializationFilter

java.lang.Object

com.dna.jopt.io.shared.DeserializationFilter

All Implemented Interfaces:

ObjectInputFilter

public final class DeserializationFilter
extends Object
implements ObjectInputFilter

The allow list for Java deserialization in the core.

Every ObjectInputStream that the core reads gets this filter (the container import of EntityContainerImporter and the legacy license stream of IOptimization.setLicense(ObjectInputStream)). The filter accepts the core's own classes ( com.dna.jopt.**) and only the JDK and library classes that a serialized container or license holds: boxed numbers, java.time values, the expiry date of the license, JDK collections, the Guava table of the node connector and the quantities and units of javax.measure. Every other class is rejected before it is created, so a stream cannot bring further classes of the JDK or of a library into the process, for example collections whose deserialization is known to be unsafe.

The filter sets no limits on depth, references, array length or stream size: they grow with the size of a container, and no fixed value is safe for every legal container.

A JVM-wide filter (the system property jdk.serialFilter) keeps applying: a class has to pass both. A refused class makes readObject throw an InvalidClassException; describe(InvalidClassException) names the refused class.

Nested Class Summary

Nested classes/interfaces inherited from interface java.io.ObjectInputFilter

ObjectInputFilter.Config, ObjectInputFilter.FilterInfo, ObjectInputFilter.Status

Field Summary

Fields

Modifier and Type	Field	Description
static final String	ALLOW_LIST	The allow list in the pattern syntax of ObjectInputFilter.Config.createFilter(String).

Method Summary

Modifier and Type	Method	Description
ObjectInputFilter.Status	checkInput(ObjectInputFilter.FilterInfo filterInfo)
InvalidClassException	describe(InvalidClassException e)	Returns the exception to report for a failed read: if this filter refused a class, an InvalidClassException that names the class and has the given exception as its cause, otherwise the given exception.
static DeserializationFilter	setOn(ObjectInputStream ois)	Sets a new filter with the allow list on a stream.

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Field Details

ALLOW_LIST

public static final String ALLOW_LIST

The allow list in the pattern syntax of ObjectInputFilter.Config.createFilter(String). For an array the pattern applies to its element type; arrays of primitives are accepted.

Method Details

setOn

public static DeserializationFilter setOn(ObjectInputStream ois)

Sets a new filter with the allow list on a stream. The filter the stream holds so far (the JVM-wide filter, if one is set) keeps applying.

Parameters:

ois - a stream that has no filter of its own and from which no object has been read yet

Returns:

the filter set on the stream

Throws:

IllegalStateException - if the stream already has a filter of its own or an object has been read from it (see ObjectInputStream.setObjectInputFilter(ObjectInputFilter))

checkInput

public ObjectInputFilter.Status checkInput(ObjectInputFilter.FilterInfo filterInfo)

Specified by:

checkInput in interface ObjectInputFilter

describe

public InvalidClassException describe(InvalidClassException e)

Returns the exception to report for a failed read: if this filter refused a class, an InvalidClassException that names the class and has the given exception as its cause, otherwise the given exception.

Parameters:

e - the exception that readObject threw

Returns:

the exception to report