RFR: 8283093: JMX connections should default to using an ObjectInputFilter [v3]

[Daniel Fuchs]

On Fri, 21 Oct 2022 09:59:15 GMT, Kevin Walls <kevinw at openjdk.org> wrote:

>> src/jdk.management.agent/share/conf/management.properties line 306:
>> 
>>> 304: #   Otherwise, the status is UNDECIDED.
>>> 305: com.sun.management.jmxremote.serial.filter.pattern=java.lang.*;java.math.BigInteger;java.math.BigDecimal;java.util.*;javax.management.openmbean.*;javax.management.ObjectName;java.rmi.MarshalledObject;javax.security.auth.Subject;!*
>>> 306: 
>> 
>> Should the pattern also include the name of the module that define these type?
>
> Thinking that won't matter for packages like java.lang but we could mention somewhere (e.g. release note) that a package can be specified (it's documented in the ObjectInputFilter api docs I think).

Yes. It would matter for any package not in the java space that has a pattern allowing recursive match, like e.g. `<package-prefix>.**` ; In that case specifying the module would be important.

-------------

PR: https://git.openjdk.org/jdk/pull/10507