<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
</head>
<body text="#000000" bgcolor="#FFFFE0">
Hi Max,<br>
<br>
<div class="moz-cite-prefix">On 8/14/2018 12:29 AM, Weijun Wang
wrote:
</div>
<blockquote type="cite"
cite="mid:F40B9173-1B4D-44CF-8777-EDB68C7283D9@oracle.com">
<blockquote type="cite">
<pre wrap="">On Aug 7, 2018, at 10:57 PM, Roger Riggs <a class="moz-txt-link-rfc2396E" href="mailto:roger.riggs@oracle.com"><roger.riggs@oracle.com></a> wrote:
Hi Max,
It may be useful to include in the descriptions a reminder that if no ObjectInputFilter
is supplied the global filter is used. Details in ObjectInputStream.
</pre>
</blockquote>
<pre wrap="">
The new getObject() methods with an ObjectInputFilter does not allow it to be null, so it looks strange to mention this in the method spec.</pre>
</blockquote>
True, the system filter would only apply to the original getObject()
method in which a serial filter is not supplied.
<blockquote type="cite"
cite="mid:F40B9173-1B4D-44CF-8777-EDB68C7283D9@oracle.com">
<pre wrap="">
I'm thinking about these changes in the example part of the class spec:
* Signature.getInstance(algorithm, provider);
* if (so.verify(publickey, verificationEngine))
* try {
- * Object myobj = so.getObject();
+ * ObjectInputFilter myfilter = ...;
+ * Object myobj = so.getObject(myfilter);
* } catch (java.lang.ClassNotFoundException e) {};
* }</pre>
*
+ * In this example, the {@link ObjectInputFilter} object is used during
+ * deserialization to check the contents of the stream. If {@link #getObject()}
+ * is called, the {@link ObjectInputFilter.Config#getSerialFilter()
+ * initial process-wide filter} is used.
I copied the words from ObjectInputStream::getObjectInputFilter. Is this a formal name of the "global filter"?</pre>
</blockquote>
I've had a request to update the terminology, so 'system filter'
will be more appropriate.<br>
[1] <a href="https://bugs.openjdk.java.net/browse/JDK-8202675">8202675</a>
Replace process-wide terminology in serial filtering to be
consistent<br>
<br>
Regards, Roger<br>
<br>
<blockquote type="cite"
cite="mid:F40B9173-1B4D-44CF-8777-EDB68C7283D9@oracle.com">
<blockquote type="cite">
<pre wrap="">Thanks, Roger
On 8/7/18 2:31 AM, Weijun Wang wrote:
</pre>
<blockquote type="cite">
<pre wrap="">Please review the code change at
webrev: <a class="moz-txt-link-freetext" href="http://cr.openjdk.java.net/~weijun/8193859/webrev.00/">http://cr.openjdk.java.net/~weijun/8193859/webrev.00/</a>
where
JBS: <a class="moz-txt-link-freetext" href="https://bugs.openjdk.java.net/browse/JDK-8193859">https://bugs.openjdk.java.net/browse/JDK-8193859</a>
CSR: <a class="moz-txt-link-freetext" href="https://bugs.openjdk.java.net/browse/JDK-8193887">https://bugs.openjdk.java.net/browse/JDK-8193887</a>
Thanks
Max
</pre>
</blockquote>
<pre wrap="">
</pre>
</blockquote>
<pre wrap="">
</pre>
</blockquote>
<br>
</body>
</html>