[
https://issues.apache.org/jira/browse/ARTEMIS-4167?focusedWorklogId=939541&page=com.atlassian.jira.plugin.system.issuetabpanels:worklog-tabpanel#worklog-939541
]
ASF GitHub Bot logged work on ARTEMIS-4167:
-------------------------------------------
Author: ASF GitHub Bot
Created on: 22/Oct/24 16:44
Start Date: 22/Oct/24 16:44
Worklog Time Spent: 10m
Work Description: gemmellr commented on code in PR #5307:
URL: https://github.com/apache/activemq-artemis/pull/5307#discussion_r1811050911
##########
docs/user-manual/security.adoc:
##########
@@ -1431,6 +1431,16 @@ comma separated values for allow list
These properties, once specified, are eventually set on the corresponding
internal factories.
+=== Filtering using built-in JVM support
+
+Now that Apache ActiveMQ Artemis requires a minimum JVM version of 11,
built-in Java serialization filtering mechanisms can be utilized.
+Instead of providing an `allow list` or `deny list`, you can specify either a
`serialFilter` or `serialFilterClassName`.
Review Comment:
I dont really see a need to include 'Now that Apache ActiveMQ Artemis
requires a minimum JVM version of 11'. It conveys nothing particularly useful
or necessary about the functionality. Its also just going to go stale.
Simply stating that you can pass a filter string / class name to leverage
the built in ObjectInputFilter support is all thats needed.
##########
docs/user-manual/security.adoc:
##########
@@ -1431,6 +1431,16 @@ comma separated values for allow list
These properties, once specified, are eventually set on the corresponding
internal factories.
+=== Filtering using built-in JVM support
+
+Now that Apache ActiveMQ Artemis requires a minimum JVM version of 11,
built-in Java serialization filtering mechanisms can be utilized.
+Instead of providing an `allow list` or `deny list`, you can specify either a
`serialFilter` or `serialFilterClassName`.
+
+* `serialFilter` - A pattern based filter that allows you to define allow/deny
lists and constraints limiting graph complexity and size.
https://docs.oracle.com/en/java/javase/17/core/serialization-filtering1.html#JSCOR-GUID-8296D8E8-2B93-4B9A-856E-0A65AF9B8C66[Filter
Syntax]
+* `serialFilterClassName` - For those who need a custom filtering solution,
you can supply an implementation of
https://docs.oracle.com/en/java/javase/17/docs/api/java.base/java/io/ObjectInputFilter.html[ObjectInputFilter]
Review Comment:
Including any details around the impact (e.g precedence) if more than one of
the now-several options is specified would also be good. Or else saying, and
enforcing, that you cant specify the different approaches at the same time.
##########
docs/user-manual/security.adoc:
##########
@@ -1431,6 +1431,16 @@ comma separated values for allow list
These properties, once specified, are eventually set on the corresponding
internal factories.
+=== Filtering using built-in JVM support
+
+Now that Apache ActiveMQ Artemis requires a minimum JVM version of 11,
built-in Java serialization filtering mechanisms can be utilized.
+Instead of providing an `allow list` or `deny list`, you can specify either a
`serialFilter` or `serialFilterClassName`.
+
+* `serialFilter` - A pattern based filter that allows you to define allow/deny
lists and constraints limiting graph complexity and size.
https://docs.oracle.com/en/java/javase/17/core/serialization-filtering1.html#JSCOR-GUID-8296D8E8-2B93-4B9A-856E-0A65AF9B8C66[Filter
Syntax]
Review Comment:
Just as Justin didnt really like "serialFilter" originally on the earlier PR
(#4368), I still cant say I am a fan of it.
The more fully elaborated deserializationFilter name would seem more obvious
to me.
Issue Time Tracking
-------------------
Worklog Id: (was: 939541)
Time Spent: 3h 40m (was: 3.5h)
> Enhance deserialization filter beyond black/whitelist functionality
> -------------------------------------------------------------------
>
> Key: ARTEMIS-4167
> URL: https://issues.apache.org/jira/browse/ARTEMIS-4167
> Project: ActiveMQ Artemis
> Issue Type: New Feature
> Reporter: Scott Werner
> Priority: Minor
> Labels: pull-request-available
> Time Spent: 3h 40m
> Remaining Estimate: 0h
>
> Now that Artemis is Java 11+ compatible, there is now the ability to set an
> ObjectInputFilter on an ObjectInputStream. There are also built in methods to
> generate filters similar to the current syntax and offers many other features
> out of the box. A global jvm property (jdk.serialFilter) can be set, but this
> is quite restrictive. I suggest adding a new serial filter pattern and class
> name of an ObjectInputFilter implementation, everywhere blacklist/whitelist
> exist today. In time we can look into converting the existing black/whitelist
> to the new format or just deprecating as the semantics are a bit different
> and may not be able to make it 100% compatible.
>
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
For further information, visit: https://activemq.apache.org/contact
