Top Description Fields Constructors Methods
org.apache.logging.log4j.util.internal

public final Class SerializationUtil

extends Object
Class Inheritance
Imports
edu.umd.cs.findbugs.annotations.SuppressFBWarnings, java.io.ByteArrayInputStream, .ByteArrayOutputStream, .IOException, .ObjectInputStream, .ObjectOutputStream, .Serializable, .StreamCorruptedException, java.lang.reflect.InvocationTargetException, .Method, .Modifier, java.util.Arrays, .List, org.apache.logging.log4j.status.StatusLogger, org.apache.logging.log4j.util.FilteredObjectInputStream
Provides methods to increase the safety of object serialization/deserialization.

Field Summary

Modifier and TypeField and Description
private static final String
DEFAULT_FILTER_CLASS

private static final Method
getObjectInputFilter

private static final Method
newObjectInputFilter

public static final List<String>
REQUIRED_JAVA_CLASSES

public static final List<String>
REQUIRED_JAVA_PACKAGES

private static final Method
setObjectInputFilter

Constructor Summary

AccessConstructor and Description
private
SerializationUtil()

Method Summary

Modifier and TypeMethod and Description
public static void
assertFiltered(final ObjectInputStream stream)

public static Object
readWrappedObject(final ObjectInputStream in)

public static void
writeWrappedObject(final Serializable obj, final ObjectOutputStream out)

Inherited from java.lang.Object:
cloneequalsfinalizegetClasshashCodenotifynotifyAlltoStringwaitwaitwait

Field Detail

DEFAULT_FILTER_CLASSback to summary
private static final String DEFAULT_FILTER_CLASS
getObjectInputFilterback to summary
private static final Method getObjectInputFilter
newObjectInputFilterback to summary
private static final Method newObjectInputFilter
REQUIRED_JAVA_CLASSESback to summary
public static final List<String> REQUIRED_JAVA_CLASSES
REQUIRED_JAVA_PACKAGESback to summary
public static final List<String> REQUIRED_JAVA_PACKAGES
setObjectInputFilterback to summary
private static final Method setObjectInputFilter

Constructor Detail

SerializationUtilback to summary
private SerializationUtil()

Method Detail

assertFilteredback to summary
public static void assertFiltered(final ObjectInputStream stream)
readWrappedObjectback to summary
public static Object readWrappedObject(final ObjectInputStream in) throws IOException, ClassNotFoundException
Annotations
@SuppressFBWarnings:OBJECT_DESERIALIZATION
justification:Object deserialization uses either Java 9 native filter or our custom filter to limit the kinds of classes deserialized.
writeWrappedObjectback to summary
public static void writeWrappedObject(final Serializable obj, final ObjectOutputStream out) throws IOException