RFR: 8278087: Deserialization filter and filter factory property error reporting under specified

Roger Riggs rriggs at openjdk.java.net
Fri Dec 3 15:50:14 UTC 2021


On Wed, 1 Dec 2021 18:19:05 GMT, Roger Riggs <rriggs at openjdk.org> wrote:

> The effects of invalid values of `jdk.serialFilter` and `jdk.serialFilterFactory` properties are 
> incompletely specified. The behavior for invalid values of the properties is different and
> use an unconventional exception type, `ExceptionInInitializerError` and leave the `OIF.Config` class
> uninitialized. 
> 
> The exceptions in the `ObjectInputFilter.Config` class initialization caused by invalid values of the two properties, 
> either by system properties supplied on the command line or security properties are logged.
> The `Config` class marks either or both the filter and filter factory values as unusable
> and remembers the exception message.
> 
> Subsequent calls to the methods that get or set the filter or filter factory or create 
> an `ObjectInputStream` throw `java.lang.IllegalStateException` with the remembered exception message.
> Constructing an `ObjectInputStream` calls both `Config.getSerialFilter` and `Config.getSerialFilterFactory`.
> The nature of the invalid property is reported as an `IllegalStateException` on first use.
> 
> This PR supercedes https://github.com/openjdk/jdk/pull/6508 Document that setting an invalid property jdk.serialFilter disables deserialization

@stuart-marks, @jaikiran Please review,  Thanks

-------------

PR: https://git.openjdk.java.net/jdk/pull/6645


More information about the core-libs-dev mailing list