[jdk20] RFR: 8299891: JMX ObjectInputFilter additional classes needed [v2]

[Chris Plummer]

On Mon, 30 Jan 2023 20:11:06 GMT, Kevin Walls <kevinw at openjdk.org> wrote:

>> src/jdk.management.agent/share/conf/management.properties line 323:
>> 
>>> 321: java.rmi.dgc.*;\
>>> 322: java.rmi.server.*;\
>>> 323: javax.security.auth.Subject;!*
>> 
>> What does the ! at the end indicate?
>
> It's "not everything else".
> 
> https://docs.oracle.com/en/java/javase/19/core/serialization-filtering1.html
> 
> "If a class name doesn’t match any filter, then it is allowed. If you want to allow only certain class names, then your filter must reject everything that doesn’t match. To reject all class names other than those specified, include !* as the last pattern in a class filter."

Ok. It would be good to clarify that in the comment above this filter. Also, maybe put it on a new line. Otherwise at first glance it appears to have a relationship to the class immediately before it.

Does this mean that this filter list would serve no purpose if the !* was omitted? I'm just curious as to why the !* is needed rather than it just being default behavior that a class has to match a filter in the list.

-------------

PR: https://git.openjdk.org/jdk20/pull/97