On Mon, 24 May 2021 17:24:22 GMT, Roger Riggs <rri...@openjdk.org> wrote:
>> JEP 415: Context-specific Deserialization Filters extends the >> deserialization filtering mechanisms with more flexible and customizable >> protections against malicious deserialization. See JEP 415: >> https://openjdk.java.net/jeps/415. >> The `java.io.ObjectInputFilter` and `java.io.ObjectInputStream` classes are >> extended with additional >> configuration mechanisms and filter utilities. >> >> javadoc for `ObjectInputFilter`, `ObjectInputFilter.Config`, and >> `ObjectInputStream`: >> >> http://cr.openjdk.java.net/~rriggs/filter-factory/java.base/java/io/ObjectInputFilter.html > > Roger Riggs has updated the pull request incrementally with one additional > commit since the last revision: > > Review suggestions included; > Added @implSpec for default methods in OIF; > Added restriction that the filter factory cannot be set after an > ObjectInputStream has been created and applied the current filter factory Changes requested by bchristi (Reviewer). src/java.base/share/classes/java/io/ObjectInputFilter.java line 1222: > 1220: /** > 1221: * Apply the predicate to the class being deserialized, if > the class is non-null > 1222: * and if it returns {@code true}, return the requested > status. Otherwise, return UNDECIDED. Isn't `ifFalseStatus` returned in the "otherwise" case, not (necessarily) `UNDECIDED` ? src/java.base/share/classes/java/io/ObjectInputFilter.java line 1236: > 1234: public String toString() { > 1235: return "predicate(" + predicate + ")"; > 1236: } Would it also be useful to also print `ifTrueStatus` and `ifFalseStatus` ? Not sure, given this is an internal class... src/java.base/share/classes/java/io/ObjectInputFilter.java line 1283: > 1281: * Returns REJECTED if either of the filters returns > REJECTED, > 1282: * and ALLOWED if either of the filters returns ALLOWED. > 1283: * Returns {@code UNDECIDED} if either filter returns > {@code UNDECIDED}. The description of when `UNDECIDED` is returned should match `@return`. Alternately, have minimal documentation here, and refer to the public merge() method, which this implements. ------------- PR: https://git.openjdk.java.net/jdk/pull/3996
