RFR: 8264859: Implement Context-Specific Deserialization Filters [v8]

[Roger Riggs]

On Tue, 25 May 2021 21:53:26 GMT, Brent Christian <bchristi at openjdk.org> wrote:

>> Roger Riggs has updated the pull request incrementally with two additional commits since the last revision:
>> 
>>  - Moved utility filter methods to be static on ObjectInputFilter
>>    Rearranged the class javadoc of OIF to describe the parts of
>>    deserialization filtering, filters, composite filters, and the filter factory.
>>    And other review comment updates...
>>  - Refactored tests for utility functions to SerialFilterFunctionTest.java
>>    Deleted confused Config.allowMaxLimits() method
>>    Updated example to match move of methods to Config
>>    Added test of restriction on setting the filterfactory after a OIS has been created
>>    Additional Editorial updates
>
> src/java.base/share/classes/java/io/ObjectInputFilter.java line 205:
> 
>> 203:  *     // Returns a composite filter of the static JVM-wide filter, a thread-specific filter,
>> 204:  *     // and the stream-specific filter.
>> 205:  *     public ObjectInputFilter apply(ObjectInputFilter curr, ObjectInputFilter next) {
> 
> `@Override` on `apply` ?

yes, but omitted to make the code more readable.

-------------

PR: https://git.openjdk.java.net/jdk/pull/3996