[jdk20] RFR: 8299891: JMX ObjectInputFilter additional classes needed [v2]

[Kevin Walls]

On Mon, 30 Jan 2023 19:21:37 GMT, Chris Plummer <cjplummer at openjdk.org> wrote:

>> Kevin Walls has updated the pull request incrementally with two additional commits since the last revision:
>> 
>>  - filter properties update: more classes logged as ALLOWED during wider testing
>>  - Add a Notification test
>
> src/jdk.management.agent/share/conf/management.properties line 323:
> 
>> 321: java.rmi.dgc.*;\
>> 322: java.rmi.server.*;\
>> 323: javax.security.auth.Subject;!*
> 
> What does the ! at the end indicate?

It's "not everything else".

https://docs.oracle.com/en/java/javase/19/core/serialization-filtering1.html

"If a class name doesn’t match any filter, then it is allowed. If you want to allow only certain class names, then your filter must reject everything that doesn’t match. To reject all class names other than those specified, include !* as the last pattern in a class filter."

-------------

PR: https://git.openjdk.org/jdk20/pull/97