[12] RFR 8193859: Allow user provided ObjectInputFilter in SealedObject and SignedObject
Weijun Wang
weijun.wang at oracle.com
Tue Aug 21 03:06:01 UTC 2018
I might be a little too quick saying "I will".
The current class spec has
* In this example, an {@link ObjectInputFilter} is used during
* deserialization of the original object. If {@link #getObject()} is
* called, the {@link ObjectInputFilter.Config#getSerialFilter()
* system filter} is used instead.
There are two "is used" here and I think people will understand they are the same, i.e. both "during the deserialization of...".
That said, I think "before it is returned" is useful. How about this?
* In this example, an {@link ObjectInputFilter} is used during
* deserialization of the original object before it is returned. If {@link #getObject()} is
* called, the {@link ObjectInputFilter.Config#getSerialFilter()
* system filter} is used instead.
> On Aug 21, 2018, at 7:08 AM, Weijun Wang <weijun.wang at oracle.com> wrote:
>
>
>>
>> - SignedObject
>>
>> 69 * called, the {@link ObjectInputFilter.Config#getSerialFilter()
>> 70 * system filter} is used instead.
>>
>> "used instead" sounds like the getSerialFilter method returns the object. Suggest being more specific and saying something like:
>>
>> "the {@link ObjectInputFilter.Config#getSerialFilter()
>> system filter} is called to validate the object before it is returned."
We cannot say "is called" here. Although the @link points to a method the text is "system filter".
Thanks
Max
>>
>> - SealedObject
>>
>> 92 * is called, the {@link ObjectInputFilter.Config#getSerialFilter()
>> 93 * system filter} is used instead.
>>
>> Same comment as above on the wording.
>
> I'll make the change as you suggested.
>>>>
>>>>>
>>>>> --Max
>>>>>
>>>>>> [1] 8202675 Replace process-wide terminology in serial filtering to be consistent
>>>>>>
>>>>>> Regards, Roger
More information about the security-dev
mailing list