Spring Framework 6.1.4 · org.springframework.core.ConfigurableObjectInputStream

Modifier and Type	Field and Description
private final boolean	acceptProxyClasses
private final ClassLoader	classLoader

Access	Constructor and Description
public	ConfigurableObjectInputStream(InputStream the InputStream to read from in, ClassLoader the ClassLoader to use for loading local classes classLoader) Create a new ConfigurableObjectInputStream for the given InputStream and ClassLoader.
public	ConfigurableObjectInputStream(InputStream the InputStream to read from in, ClassLoader the ClassLoader to use for loading local classes classLoader, boolean whether to accept deserialization of proxy classes (may be deactivated as a security measure) acceptProxyClasses) Create a new ConfigurableObjectInputStream for the given InputStream and ClassLoader.

Method Summary

Modifier and Type	Method and Description
protected ClassLoader	getFallbackClassLoader() Return the fallback ClassLoader to use when no ClassLoader was specified and ObjectInputStream's own default class loader failed.
protected Class<?>	resolveClass(ObjectStreamClass an instance of class `ObjectStreamClass` classDesc) Overrides java.io.ObjectInputStream.resolveClass. Load the local class equivalent of the specified stream class description.
protected Class<?>	Returns: the newly resolved class (never `null`) resolveFallbackIfPossible(String the class name to resolve className, ClassNotFoundException the original exception thrown when attempting to load the class ex) Resolve the given class name against a fallback class loader.
protected Class<?>	resolveProxyClass(String[] the list of interface names that were deserialized in the proxy class descriptor interfaces) Overrides java.io.ObjectInputStream.resolveProxyClass. Returns a proxy class that implements the interfaces named in a proxy class descriptor; subclasses may implement this method to read custom data from the stream along with the descriptors for dynamic proxy classes, allowing them to use an alternate loading mechanism for the interfaces and the proxy class.

acceptProxyClasses	back to summary
private final boolean acceptProxyClasses

classLoader	back to summary
private final ClassLoader classLoader Annotations @Nullable

ConfigurableObjectInputStream	back to summary
public ConfigurableObjectInputStream(InputStream in, ClassLoader classLoader) throws IOException Create a new ConfigurableObjectInputStream for the given InputStream and ClassLoader. Parameters in:InputStream the InputStream to read from classLoader:ClassLoader the ClassLoader to use for loading local classes See Also `java.io.ObjectInputStream#ObjectInputStream(java.io.InputStream)`

ConfigurableObjectInputStream	back to summary
public ConfigurableObjectInputStream(InputStream in, ClassLoader classLoader, boolean acceptProxyClasses) throws IOException Create a new ConfigurableObjectInputStream for the given InputStream and ClassLoader. Parameters in:InputStream the InputStream to read from classLoader:ClassLoader the ClassLoader to use for loading local classes acceptProxyClasses:boolean whether to accept deserialization of proxy classes (may be deactivated as a security measure) See Also `java.io.ObjectInputStream#ObjectInputStream(java.io.InputStream)`

Method Detail

getFallbackClassLoader back to summary

getFallbackClassLoader	back to summary
protected ClassLoader getFallbackClassLoader() throws IOException Return the fallback ClassLoader to use when no ClassLoader was specified and ObjectInputStream's own default class loader failed. The default implementation simply returns `null`, indicating that no specific fallback is available. Annotations @Nullable

protected ClassLoader getFallbackClassLoader() throws IOException

Return the fallback ClassLoader to use when no ClassLoader was specified and ObjectInputStream's own default class loader failed.

The default implementation simply returns null, indicating that no specific fallback is available.

Annotations

@Nullable

resolveClass back to summary

resolveClass	back to summary
protected Class<?> resolveClass(ObjectStreamClass classDesc) throws IOException, ClassNotFoundException Overrides java.io.ObjectInputStream.resolveClass. Doc from java.io.ObjectInputStream.resolveClass. Load the local class equivalent of the specified stream class description. Subclasses may implement this method to allow classes to be fetched from an alternate source. The corresponding method in `ObjectOutputStream` is `annotateClass`. This method will be invoked only once for each unique class in the stream. This method can be implemented by subclasses to use an alternate loading mechanism but must return a `Class` object. Once returned, if the class is not an array class, its serialVersionUID is compared to the serialVersionUID of the serialized class, and if there is a mismatch, the deserialization fails and an `InvalidClassException` is thrown. The default implementation of this method in `ObjectInputStream` returns the result of calling `Class.forName(desc.getName(), false, loader)` Class.forName(desc.getName(), false, loader) where `loader` is the first class loader on the current thread's stack (starting from the currently executing method) that is neither the platform class loader nor its ancestor; otherwise, `loader` is the platform class loader. If this call results in a `ClassNotFoundException` and the name of the passed `ObjectStreamClass` instance is the Java language keyword for a primitive type or void, then the `Class` object representing that primitive type or void will be returned (e.g., an `ObjectStreamClass` with the name `"int"` will be resolved to `Integer.TYPE`). Otherwise, the `ClassNotFoundException` will be thrown to the caller of this method. Parameters classDesc:ObjectStreamClass an instance of class `ObjectStreamClass` Returns:Class<?> a `Class` object corresponding to `desc` Annotations @Override Exceptions IOException: any of the usual Input/Output exceptions. ClassNotFoundException: if class of a serialized object cannot be found.

protected Class<?> resolveClass(ObjectStreamClass classDesc) throws IOException, ClassNotFoundException

Overrides java.io.ObjectInputStream.resolveClass.

Doc from java.io.ObjectInputStream.resolveClass.

Load the local class equivalent of the specified stream class description. Subclasses may implement this method to allow classes to be fetched from an alternate source.

The corresponding method in ObjectOutputStream is annotateClass. This method will be invoked only once for each unique class in the stream. This method can be implemented by subclasses to use an alternate loading mechanism but must return a Class object. Once returned, if the class is not an array class, its serialVersionUID is compared to the serialVersionUID of the serialized class, and if there is a mismatch, the deserialization fails and an InvalidClassException is thrown.

The default implementation of this method in ObjectInputStream returns the result of calling

Class.forName(desc.getName(), false, loader)

where loader is the first class loader on the current thread's stack (starting from the currently executing method) that is neither the platform class loader nor its ancestor; otherwise, loader is the platform class loader. If this call results in a ClassNotFoundException and the name of the passed ObjectStreamClass instance is the Java language keyword for a primitive type or void, then the Class object representing that primitive type or void will be returned (e.g., an ObjectStreamClass with the name "int" will be resolved to Integer.TYPE). Otherwise, the ClassNotFoundException will be thrown to the caller of this method.

Parameters

classDesc:ObjectStreamClass: an instance of class ObjectStreamClass

Returns:Class<?>

a Class object corresponding to desc

Annotations

@Override

Exceptions

IOException:: any of the usual Input/Output exceptions.
ClassNotFoundException:: if class of a serialized object cannot be found.

resolveFallbackIfPossible back to summary

resolveFallbackIfPossible	back to summary
protected Class<?> resolveFallbackIfPossible(String className, ClassNotFoundException ex) throws IOException, ClassNotFoundException Resolve the given class name against a fallback class loader. The default implementation simply rethrows the original exception, since there is no fallback available. Parameters className:String the class name to resolve ex:ClassNotFoundException the original exception thrown when attempting to load the class Returns:Class<?> the newly resolved class (never `null`)

protected Class<?> resolveFallbackIfPossible(String className, ClassNotFoundException ex) throws IOException, ClassNotFoundException

Resolve the given class name against a fallback class loader.

The default implementation simply rethrows the original exception, since there is no fallback available.

Parameters

className:String: the class name to resolve
ex:ClassNotFoundException: the original exception thrown when attempting to load the class

Returns:Class<?>

the newly resolved class (never null)

resolveProxyClass back to summary

resolveProxyClass	back to summary
protected Class<?> resolveProxyClass(String[] interfaces) throws IOException, ClassNotFoundException Overrides java.io.ObjectInputStream.resolveProxyClass. Doc from java.io.ObjectInputStream.resolveProxyClass. Returns a proxy class that implements the interfaces named in a proxy class descriptor; subclasses may implement this method to read custom data from the stream along with the descriptors for dynamic proxy classes, allowing them to use an alternate loading mechanism for the interfaces and the proxy class. This method is called exactly once for each unique proxy class descriptor in the stream. The corresponding method in `ObjectOutputStream` is `annotateProxyClass`. For a given subclass of `ObjectInputStream` that overrides this method, the `annotateProxyClass` method in the corresponding subclass of `ObjectOutputStream` must write any data or objects read by this method. The default implementation of this method in `ObjectInputStream` returns the result of calling `Proxy.getProxyClass` with the list of `Class` objects for the interfaces that are named in the `interfaces` parameter. The `Class` object for each interface name `i` is the value returned by calling `Class.forName(i, false, loader)` Class.forName(i, false, loader) where `loader` is the first class loader on the current thread's stack (starting from the currently executing method) that is neither the platform class loader nor its ancestor; otherwise, `loader` is the platform class loader. Unless any of the resolved interfaces are non-public, this same value of `loader` is also the class loader passed to `Proxy.getProxyClass`; if non-public interfaces are present, their class loader is passed instead (if more than one non-public interface class loader is encountered, an `IllegalAccessError` is thrown). If `Proxy.getProxyClass` throws an `IllegalArgumentException`, `resolveProxyClass` will throw a `ClassNotFoundException` containing the `IllegalArgumentException`. Parameters interfaces:String[] the list of interface names that were deserialized in the proxy class descriptor Returns:Class<?> a proxy class for the specified interfaces Annotations @Override Exceptions IOException: any exception thrown by the underlying `InputStream` ClassNotFoundException: if the proxy class or any of the named interfaces could not be found

protected Class<?> resolveProxyClass(String[] interfaces) throws IOException, ClassNotFoundException

Overrides java.io.ObjectInputStream.resolveProxyClass.

Doc from java.io.ObjectInputStream.resolveProxyClass.

Returns a proxy class that implements the interfaces named in a proxy class descriptor; subclasses may implement this method to read custom data from the stream along with the descriptors for dynamic proxy classes, allowing them to use an alternate loading mechanism for the interfaces and the proxy class.

This method is called exactly once for each unique proxy class descriptor in the stream.

The corresponding method in ObjectOutputStream is annotateProxyClass. For a given subclass of ObjectInputStream that overrides this method, the annotateProxyClass method in the corresponding subclass of ObjectOutputStream must write any data or objects read by this method.

The default implementation of this method in ObjectInputStream returns the result of calling Proxy.getProxyClass with the list of Class objects for the interfaces that are named in the interfaces parameter. The Class object for each interface name i is the value returned by calling

Class.forName(i, false, loader)

where loader is the first class loader on the current thread's stack (starting from the currently executing method) that is neither the platform class loader nor its ancestor; otherwise, loader is the platform class loader. Unless any of the resolved interfaces are non-public, this same value of loader is also the class loader passed to Proxy.getProxyClass; if non-public interfaces are present, their class loader is passed instead (if more than one non-public interface class loader is encountered, an IllegalAccessError is thrown). If Proxy.getProxyClass throws an IllegalArgumentException, resolveProxyClass will throw a ClassNotFoundException containing the IllegalArgumentException.

Parameters

interfaces:String[]: the list of interface names that were deserialized in the proxy class descriptor

Returns:Class<?>

a proxy class for the specified interfaces

Annotations

@Override

Exceptions

IOException:: any exception thrown by the underlying InputStream
ClassNotFoundException:: if the proxy class or any of the named interfaces could not be found

public Class ConfigurableObjectInputStream

Field Summary

Constructor Summary

Method Summary

Field Detail

Constructor Detail

Method Detail