RFR: 8264859: Implement Context-Specific Deserialization Filters [v5]
Roger Riggs
rriggs at openjdk.java.net
Mon May 24 16:52:12 UTC 2021
On Mon, 24 May 2021 10:58:41 GMT, Chris Hegarty <chegar at openjdk.org> wrote:
>> Roger Riggs has updated the pull request incrementally with one additional commit since the last revision:
>>
>> Editorial javadoc updated based on review comments.
>> Clarified behavior of rejectUndecidedClass method.
>> Example test added to check status returned from file.
>
> src/java.base/share/classes/java/io/ObjectInputFilter.java line 829:
>
>> 827: * Returns a filter that returns {@code Status.ALLOWED} if the check is for limits
>> 828: * and not checking a class; otherwise {@code Status.UNDECIDED}.
>> 829: * If the {@link FilterInfo#serialClass()} is {@code null}, the filter returns
>
> "Returns a filter that returns {@code Status.ALLOWED} ... ". Maybe "Returns a filter that allows all limits ..".
>
> Up-levelling a bit, it seems that filter operations fall into two broad categories: 1) class-checking, and 2)limits-checking. At least, in the way that some of these factories and adapters are laid out. If we had such a notional at the class-level, then maybe that could influence the naming of these factories - and tie them to a higher-level concept.
I'll add some higher level descriptions to the Config class and to ObjectInputFilter class doc.
-------------
PR: https://git.openjdk.java.net/jdk/pull/3996
More information about the core-libs-dev
mailing list