[12] RFR 8193859: Allow user provided ObjectInputFilter in SealedObject and SignedObject

Weijun Wang weijun.wang at oracle.com
Tue Aug 21 03:06:01 UTC 2018


I might be a little too quick saying "I will".

The current class spec has

* In this example, an {@link ObjectInputFilter} is used during
* deserialization of the original object. If {@link #getObject()} is
* called, the {@link ObjectInputFilter.Config#getSerialFilter()
* system filter} is used instead.

There are two "is used" here and I think people will understand they are the same, i.e. both "during the deserialization of...".

That said, I think "before it is returned" is useful. How about this?

* In this example, an {@link ObjectInputFilter} is used during
* deserialization of the original object before it is returned. If {@link #getObject()} is
* called, the {@link ObjectInputFilter.Config#getSerialFilter()
* system filter} is used instead.

> On Aug 21, 2018, at 7:08 AM, Weijun Wang <weijun.wang at oracle.com> wrote:
> 
> 
>> 
>> - SignedObject
>> 
>> 69  * called, the {@link ObjectInputFilter.Config#getSerialFilter()
>> 70  * system filter} is used instead.
>> 
>> "used instead" sounds like the getSerialFilter method returns the object. Suggest being more specific and saying something like:
>> 
>> "the {@link ObjectInputFilter.Config#getSerialFilter()
>> system filter} is called to validate the object before it is returned."

We cannot say "is called" here. Although the @link points to a method the text is "system filter".

Thanks
Max

>> 
>> - SealedObject
>> 
>> 92  * is called, the {@link ObjectInputFilter.Config#getSerialFilter()
>> 93  * system filter} is used instead.
>> 
>> Same comment as above on the wording.
> 
> I'll make the change as you suggested.
>>>> 
>>>>> 
>>>>> --Max
>>>>> 
>>>>>> [1]    8202675  Replace process-wide terminology in serial filtering to be consistent
>>>>>> 
>>>>>> Regards, Roger




More information about the security-dev mailing list