< prev index next >

src/java.base/share/classes/java/io/ObjectInputFilter.java

Print this page
rev 51958 : 8211122: Reduce the number of internal classes made accessible to jdk.unsupported
Reviewed-by: alanb, dfuchs, kvn
   1 /*
   2  * Copyright (c) 2016, Oracle and/or its affiliates. All rights reserved.
   3  * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
   4  *
   5  * This code is free software; you can redistribute it and/or modify it
   6  * under the terms of the GNU General Public License version 2 only, as
   7  * published by the Free Software Foundation.  Oracle designates this
   8  * particular file as subject to the "Classpath" exception as provided
   9  * by Oracle in the LICENSE file that accompanied this code.
  10  *
  11  * This code is distributed in the hope that it will be useful, but WITHOUT
  12  * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
  13  * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
  14  * version 2 for more details (a copy is included in the LICENSE file that
  15  * accompanied this code).
  16  *
  17  * You should have received a copy of the GNU General Public License version
  18  * 2 along with this work; if not, write to the Free Software Foundation,
  19  * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
  20  *
  21  * Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
  22  * or visit www.oracle.com if you need additional information or have any
  23  * questions.
  24  */
  25 
  26 package java.io;
  27 
  28 import java.security.AccessController;
  29 import java.security.PrivilegedAction;
  30 import java.security.Security;
  31 import java.util.ArrayList;
  32 import java.util.List;
  33 import java.util.Objects;
  34 import java.util.Optional;
  35 import java.util.function.Function;
  36 
  37 import jdk.internal.misc.SharedSecrets;
  38 
  39 /**
  40  * Filter classes, array lengths, and graph metrics during deserialization.
  41  *
  42  * <p><strong>Warning: Deserialization of untrusted data is inherently dangerous
  43  * and should be avoided. Untrusted data should be carefully validated according to the
  44  * "Serialization and Deserialization" section of the
  45  * {@extLink secure_coding_guidelines_javase Secure Coding Guidelines for Java SE}.
  46  * {@extLink serialization_filter_guide Serialization Filtering} describes best
  47  * practices for defensive use of serial filters.
  48  * </strong></p>
  49  *
  50  * If set on an {@link ObjectInputStream}, the {@link #checkInput checkInput(FilterInfo)}
  51  * method is called to validate classes, the length of each array,
  52  * the number of objects being read from the stream, the depth of the graph,
  53  * and the total number of bytes read from the stream.
  54  * <p>
  55  * A filter can be set via {@link ObjectInputStream#setObjectInputFilter setObjectInputFilter}
  56  * for an individual ObjectInputStream.
  57  * A filter can be set via {@link Config#setSerialFilter(ObjectInputFilter) Config.setSerialFilter}


   1 /*
   2  * Copyright (c) 2016, 2018, Oracle and/or its affiliates. All rights reserved.
   3  * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
   4  *
   5  * This code is free software; you can redistribute it and/or modify it
   6  * under the terms of the GNU General Public License version 2 only, as
   7  * published by the Free Software Foundation.  Oracle designates this
   8  * particular file as subject to the "Classpath" exception as provided
   9  * by Oracle in the LICENSE file that accompanied this code.
  10  *
  11  * This code is distributed in the hope that it will be useful, but WITHOUT
  12  * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
  13  * FITNESS FOR A PARTICULAR PURPOSE.  See the GNU General Public License
  14  * version 2 for more details (a copy is included in the LICENSE file that
  15  * accompanied this code).
  16  *
  17  * You should have received a copy of the GNU General Public License version
  18  * 2 along with this work; if not, write to the Free Software Foundation,
  19  * Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
  20  *
  21  * Please contact Oracle, 500 Oracle Parkway, Redwood Shores, CA 94065 USA
  22  * or visit www.oracle.com if you need additional information or have any
  23  * questions.
  24  */
  25 
  26 package java.io;
  27 
  28 import java.security.AccessController;
  29 import java.security.PrivilegedAction;
  30 import java.security.Security;
  31 import java.util.ArrayList;
  32 import java.util.List;
  33 import java.util.Objects;
  34 import java.util.Optional;
  35 import java.util.function.Function;
  36 
  37 import jdk.internal.access.SharedSecrets;
  38 
  39 /**
  40  * Filter classes, array lengths, and graph metrics during deserialization.
  41  *
  42  * <p><strong>Warning: Deserialization of untrusted data is inherently dangerous
  43  * and should be avoided. Untrusted data should be carefully validated according to the
  44  * "Serialization and Deserialization" section of the
  45  * {@extLink secure_coding_guidelines_javase Secure Coding Guidelines for Java SE}.
  46  * {@extLink serialization_filter_guide Serialization Filtering} describes best
  47  * practices for defensive use of serial filters.
  48  * </strong></p>
  49  *
  50  * If set on an {@link ObjectInputStream}, the {@link #checkInput checkInput(FilterInfo)}
  51  * method is called to validate classes, the length of each array,
  52  * the number of objects being read from the stream, the depth of the graph,
  53  * and the total number of bytes read from the stream.
  54  * <p>
  55  * A filter can be set via {@link ObjectInputStream#setObjectInputFilter setObjectInputFilter}
  56  * for an individual ObjectInputStream.
  57  * A filter can be set via {@link Config#setSerialFilter(ObjectInputFilter) Config.setSerialFilter}


< prev index next >