RFR: 8264859: Implement Context-Specific Deserialization Filters [v3]

[Roger Riggs]

On Fri, 21 May 2021 16:09:45 GMT, Chris Hegarty <chegar at openjdk.org> wrote:

>> Roger Riggs has updated the pull request incrementally with one additional commit since the last revision:
>> 
>>   Simplify factory interface to BinaryOperator<ObjectInputFilter> and cleanup the example
>
> src/java.base/share/classes/java/io/ObjectInputFilter.java line 107:
> 
>> 105:  *     Note that the filter may be used directly or combined with other filters by the
>> 106:  *     {@linkplain Config#setSerialFilterFactory(BinaryOperator) JVM-wide filter factory}.
>> 107:  * </ul>
> 
> This list is a little confusing to me, but could be that I don't fully grok it yet. getSerialFilterFactory returns THE JVM-wide factory, whether that be the built-in factory implementation or not is somewhat irrelevant. No need to treat them differently - one either sets a factory (in which case that is the JVM-wide factory), or one does not set the factory (in which case the built-in factory is the JVM-wide factory).

In previous versions, calling OIS.setObjectInputFilter determined exactly the filter used for the stream.
With the filter factory enhancement, the current filter factory determines how the argument to OIS.setObjectInputFilter is used. There are plenty of cases where the filter factory will combine it with other filters and the composite will becomes the filter for the stream.

-------------

PR: https://git.openjdk.java.net/jdk/pull/3996