<html><head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
</head>
<body>
Hi Heinz,<br>
<br>
Indeed, this example is not intuitive and does not do what was
intended and could use a better explanation.<br>
<br>
The interaction of three filters gets complicated and their
combination depends on the ordering and intention of each filter and
the particular filter factory goal. The FilterInThread example
provides only one of many possible functions.<br>
<br>
The FilterInThread example uses the JVM-wide filter, thread filter,
and stream filter for different purposes.<br>
<br>
The JVM-wide filter has a particular role in that it can be set on
the command line via a system property.<br>
It is typically used as a backstop after the application is deployed
to patch in additional rejection of classes.<br>
The property value syntax allows for either allowing or rejecting
classes, and an otherwise unmentioned class is left UNDECIDED,
possibly with some risk exposure.<br>
<br>
The thread filter is used to more focus de-serialization on a group
of classes, either to narrow it or expand it.<br>
<br>
The FilterInThread example takes the position that any UNDECIDED in
the thread's filter and the JVM-wide filter should be rejected even
if the pattern does not explicitly do so. This keeps an oversight
in filter construction from becoming a risk.<br>
<br>
The stream filter is included mostly for backward compatibility,
introduced in JDK 9 via JEP 290. The stream filter is set by the
code creating the ObjectInputStream and part of its design and
purpose. In the FilterInThread example, if it returns UNDECIDED, the
result is determined by a merge of the other two filters and further
rejecting UNDECIDED.<br>
<br>
The bug in the example, that individually rejects UNDECIDED in the
JVM-wide and thread filters respectively, should instead reject only
if both return UNDECIDED.<br>
<br>
The revised example is:<br>
<br>
<div style="background-color:#ffffff;color:#080808;font-family:'JetBrains
Mono',monospace;font-size:10.5pt;">
<pre><span style="color:#8c8c8c;font-style:italic;">*</span><span style="color:#8c8c8c;background-color:#edfced;font-style:italic;"> // Returns a composite filter of the static JVM-wide filter, a thread-specific filter,
</span><span style="color:#8c8c8c;font-style:italic;">*</span><span style="color:#8c8c8c;background-color:#edfced;font-style:italic;"> // and the stream-specific filter.
</span><span style="color:#8c8c8c;font-style:italic;">*</span><span style="color:#8c8c8c;background-color:#edfced;font-style:italic;"> public ObjectInputFilter apply(ObjectInputFilter curr, ObjectInputFilter next) {
</span><span style="color:#8c8c8c;font-style:italic;">*</span><span style="color:#8c8c8c;background-color:#edfced;font-style:italic;"> if (curr == null) {
</span><span style="color:#8c8c8c;font-style:italic;">*</span><span style="color:#8c8c8c;background-color:#edfced;font-style:italic;"> // Called from the OIS constructor or perhaps OIS.setObjectInputFilter with no current filter
</span><span style="color:#8c8c8c;font-style:italic;">*</span><span style="color:#8c8c8c;background-color:#edfced;font-style:italic;"> var filter = filterThreadLocal.get();
</span><span style="color:#8c8c8c;font-style:italic;">*</span><span style="color:#8c8c8c;background-color:#edfced;font-style:italic;"> if (filter != null) {
</span><span style="color:#8c8c8c;font-style:italic;">*</span><span style="color:#8c8c8c;background-color:#edfced;font-style:italic;"> // Merge to invoke the thread local filter and then the JVM-wide filter (if any)
</span><span style="color:#8c8c8c;font-style:italic;">*</span><span style="color:#8c8c8c;background-color:#edfced;font-style:italic;"> filter = ObjectInputFilter.merge(filter, next);
</span><span style="color:#8c8c8c;font-style:italic;">*</span><span style="color:#8c8c8c;background-color:#edfced;font-style:italic;"> return ObjectInputFilter.rejectUndecidedClass(filter);
</span><span style="color:#8c8c8c;font-style:italic;">*</span><span style="color:#8c8c8c;background-color:#edfced;font-style:italic;"> }
</span><span style="color:#8c8c8c;font-style:italic;">*</span><span style="color:#8c8c8c;background-color:#edfced;font-style:italic;"> return (next == null) ? null : ObjectInputFilter.rejectUndecidedClass(next);
</span><span style="color:#8c8c8c;font-style:italic;">*</span><span style="color:#8c8c8c;background-color:#edfced;font-style:italic;"> } else {
</span><span style="color:#8c8c8c;font-style:italic;">*</span><span style="color:#8c8c8c;background-color:#edfced;font-style:italic;"> // Called from OIS.setObjectInputFilter with a current filter and a stream-specific filter.
</span><span style="color:#8c8c8c;font-style:italic;">*</span><span style="color:#8c8c8c;background-color:#edfced;font-style:italic;"> // The curr filter already incorporates the thread filter and static JVM-wide filter
</span><span style="color:#8c8c8c;font-style:italic;">*</span><span style="color:#8c8c8c;background-color:#edfced;font-style:italic;"> // and rejection of undecided classes
</span><span style="color:#8c8c8c;font-style:italic;">*</span><span style="color:#8c8c8c;background-color:#edfced;font-style:italic;"> // If there is a stream-specific filter merge to invoke it and then the current filter.
</span><span style="color:#8c8c8c;font-style:italic;">*</span><span style="color:#8c8c8c;background-color:#edfced;font-style:italic;"> if (next != null) {
</span><span style="color:#8c8c8c;font-style:italic;">*</span><span style="color:#8c8c8c;background-color:#edfced;font-style:italic;"> return ObjectInputFilter.merge(next, curr);
</span><span style="color:#8c8c8c;font-style:italic;">*</span><span style="color:#8c8c8c;background-color:#edfced;font-style:italic;"> }
</span><span style="color:#8c8c8c;font-style:italic;">*</span><span style="color:#8c8c8c;background-color:#edfced;font-style:italic;"> return curr;
</span><span style="color:#8c8c8c;font-style:italic;">*</span><span style="color:#8c8c8c;background-color:#edfced;font-style:italic;"> }
</span><span style="color:#8c8c8c;font-style:italic;">*</span><span style="color:#8c8c8c;background-color:#edfced;font-style:italic;"> }
</span></pre>
</div>
<br>
The filters are evaluated as:<br>
merge(restrictLargeArrays,rejectUndecidedClass(merge(allowInteger,allowArrayList)))<br>
<br>
The first call to the factory returns a filter: `var f1 =
rejectUndecidedClass(merge(allowInteger,allowArrayList))`<br>
The second call to the factory returns filter: `var f2 =
merge(restrictLargeArrays, f1)`<br>
<br>
The filters are evaluated in order, until an accept or reject is
returned:<br>
1) restrictLargeArrays (stream)<br>
2) allowInteger (thread filter)<br>
3) allowArrayList (JVM-wide filter)<br>
<br>
This has the same value as your ideal but without an extra
RejectUndecidedClass.<br>
<br>
Note that in this composition, the choice by a filter to accept or
reject can not be overridden by a subsequent filter.<br>
<br>
Thank you for the comments and suggestions, Roger<br>
<br>
<div class="moz-cite-prefix">On 2/3/23 1:20 PM, Dr Heinz M. Kabutz
wrote:<br>
</div>
<blockquote type="cite" cite="mid:76209504-e958-b981-8b6b-b90955fd5f5d@javaspecialists.eu">I
was trying to get my head around the FilterInThread example in JEP
415 (<a class="moz-txt-link-freetext" href="https://openjdk.org/jeps/415">https://openjdk.org/jeps/415</a>) and the JavaDoc for the
ObjectInputFilter
(<a class="moz-txt-link-freetext" href="https://docs.oracle.com/en/java/javase/17/docs/api/java.base/java/io/ObjectInputFilter.html">https://docs.oracle.com/en/java/javase/17/docs/api/java.base/java/io/ObjectInputFilter.html</a>)<br>
<br>
For example, let's assume we have three filters. The first allow
ArrayList, the second allows Integer, the third restricts arrays
to not be larger than 1000.
<br>
<br>
ObjectInputFilter allowArrayList =
ObjectInputFilter.allowFilter(
<br>
Set.of(ArrayList.class, Object.class)::contains,
UNDECIDED
<br>
);
<br>
ObjectInputFilter allowInteger =
ObjectInputFilter.allowFilter(
<br>
Set.of(Number.class, Integer.class)::contains,
UNDECIDED
<br>
);
<br>
ObjectInputFilter restrictLargeArrays =
<br>
ObjectInputFilter.Config.createFilter("maxarray=1000");
<br>
<br>
Let's say that we create a FilterInThread instance and install
that as our factory. Furthermore, we set the allowArrayList as the
global serial filter. When we call
filterInThread.doWithSerialFilter() we pass in the allowInteger
filter. Lastly, during the actual deserialization, we call
setObjectInputFilter() on the ObjectInputStream with the
restrictLargeArrays filter. Ideally, I would want the final filter
to look like this:
<br>
<br>
rejectUndecidedClass(merge(restrictLargeArrays,merge(allowInteger,allowArrayList)))
<br>
<br>
However, in the FilterInThread example, we add the
rejectUndecidedClass() wrapper around each of the steps. Thus we
would get something like:
<br>
<br>
rejectUndecidedClass(merge(restrictLargeArrays,rejectUndecidedClass(merge(allowInteger,rejectUndecidedClass(allowArrayList)))))
<br>
<br>
Thus we could never allow any classes except for ArrayList.
<br>
<br>
<br>
Regards
<br>
<br>
Heinz
<br>
</blockquote>
<br>
</body>
</html>