RFR: 8278087: Deserialization filter and filter factory property error reporting under specified [v2]
Roger Riggs
rriggs at openjdk.java.net
Mon Dec 6 16:59:41 UTC 2021
> The effects of invalid values of `jdk.serialFilter` and `jdk.serialFilterFactory` properties are
> incompletely specified. The behavior for invalid values of the properties is different and
> use an unconventional exception type, `ExceptionInInitializerError` and leave the `OIF.Config` class
> uninitialized.
>
> The exceptions in the `ObjectInputFilter.Config` class initialization caused by invalid values of the two properties,
> either by system properties supplied on the command line or security properties are logged.
> The `Config` class marks either or both the filter and filter factory values as unusable
> and remembers the exception message.
>
> Subsequent calls to the methods that get or set the filter or filter factory or create
> an `ObjectInputStream` throw `java.lang.IllegalStateException` with the remembered exception message.
> Constructing an `ObjectInputStream` calls both `Config.getSerialFilter` and `Config.getSerialFilterFactory`.
> The nature of the invalid property is reported as an `IllegalStateException` on first use.
>
> This PR supercedes https://github.com/openjdk/jdk/pull/6508 Document that setting an invalid property jdk.serialFilter disables deserialization
Roger Riggs has updated the pull request incrementally with one additional commit since the last revision:
Address review comments to consistently identify security property names
and use the correct bug number in the test.
-------------
Changes:
- all: https://git.openjdk.java.net/jdk/pull/6645/files
- new: https://git.openjdk.java.net/jdk/pull/6645/files/4dec7f48..52ab7b5b
Webrevs:
- full: https://webrevs.openjdk.java.net/?repo=jdk&pr=6645&range=01
- incr: https://webrevs.openjdk.java.net/?repo=jdk&pr=6645&range=00-01
Stats: 13 lines in 2 files changed: 3 ins; 4 del; 6 mod
Patch: https://git.openjdk.java.net/jdk/pull/6645.diff
Fetch: git fetch https://git.openjdk.java.net/jdk pull/6645/head:pull/6645
PR: https://git.openjdk.java.net/jdk/pull/6645
More information about the core-libs-dev
mailing list