Top Description Fields Constructors Methods
org.apache.logging.log4j.util

public Class FilteredObjectInputStream

extends ObjectInputStream
Class Inheritance
Static Imports
org.apache.logging.log4j.util.internal.SerializationUtil.REQUIRED_JAVA_CLASSES, .SerializationUtil.REQUIRED_JAVA_PACKAGES
Extends ObjectInputStream to only allow some built-in Log4j classes and caller-specified classes to be deserialized.
Since
2.8.2

Field Summary

Modifier and TypeField and Description
private final Collection<String>
allowedExtraClasses

Constructor Summary

AccessConstructor and Description
public
FilteredObjectInputStream()

public
FilteredObjectInputStream(final InputStream inputStream)

public
FilteredObjectInputStream(final Collection<String> allowedExtraClasses)

public
FilteredObjectInputStream(final InputStream inputStream, final Collection<String> allowedExtraClasses)

Method Summary

Modifier and TypeMethod and Description
public Collection<String>
getAllowedClasses()

private static boolean
isAllowedByDefault(final String name)

private static boolean
isRequiredPackage(final String name)

protected Class<?>
resolveClass(final ObjectStreamClass
an instance of class ObjectStreamClass
desc)

Overrides java.io.ObjectInputStream.resolveClass.

Load the local class equivalent of the specified stream class description.

Inherited from java.io.ObjectInputStream:
availableclosedefaultReadObjectenableResolveObjectgetObjectInputFilterreadreadreadBooleanreadBytereadCharreadClassDescriptorreadDoublereadFieldsreadFloatreadFullyreadFullyreadIntreadLinereadLongreadObjectreadObjectOverridereadShortreadStreamHeaderreadUnsharedreadUnsignedBytereadUnsignedShortreadUTFregisterValidationresolveObjectresolveProxyClasssetObjectInputFilterskipBytes

Field Detail

allowedExtraClassesback to summary
private final Collection<String> allowedExtraClasses

Constructor Detail

FilteredObjectInputStreamback to summary
public FilteredObjectInputStream() throws IOException, SecurityException
FilteredObjectInputStreamback to summary
public FilteredObjectInputStream(final InputStream inputStream) throws IOException
FilteredObjectInputStreamback to summary
public FilteredObjectInputStream(final Collection<String> allowedExtraClasses) throws IOException, SecurityException
FilteredObjectInputStreamback to summary
public FilteredObjectInputStream(final InputStream inputStream, final Collection<String> allowedExtraClasses) throws IOException

Method Detail

getAllowedClassesback to summary
public Collection<String> getAllowedClasses()
isAllowedByDefaultback to summary
private static boolean isAllowedByDefault(final String name)
isRequiredPackageback to summary
private static boolean isRequiredPackage(final String name)
resolveClassback to summary
protected Class<?> resolveClass(final ObjectStreamClass desc) throws IOException, ClassNotFoundException

Overrides java.io.ObjectInputStream.resolveClass.

Doc from java.io.ObjectInputStream.resolveClass.

Load the local class equivalent of the specified stream class description. Subclasses may implement this method to allow classes to be fetched from an alternate source.

The corresponding method in ObjectOutputStream is annotateClass. This method will be invoked only once for each unique class in the stream. This method can be implemented by subclasses to use an alternate loading mechanism but must return a Class object. Once returned, if the class is not an array class, its serialVersionUID is compared to the serialVersionUID of the serialized class, and if there is a mismatch, the deserialization fails and an InvalidClassException is thrown.

The default implementation of this method in ObjectInputStream returns the result of calling

Class.forName(desc.getName(), false, loader) 
Class.forName(desc.getName(), false, loader)
where loader is the first class loader on the current thread's stack (starting from the currently executing method) that is neither the platform class loader nor its ancestor; otherwise, loader is the platform class loader. If this call results in a ClassNotFoundException and the name of the passed ObjectStreamClass instance is the Java language keyword for a primitive type or void, then the Class object representing that primitive type or void will be returned (e.g., an ObjectStreamClass with the name "int" will be resolved to Integer.TYPE). Otherwise, the ClassNotFoundException will be thrown to the caller of this method.
Parameters
desc:ObjectStreamClass

an instance of class ObjectStreamClass

Returns:Class<?>

a Class object corresponding to desc

Annotations
@Override
Exceptions
IOException:
any of the usual Input/Output exceptions.
ClassNotFoundException:
if class of a serialized object cannot be found.