[jira] [Updated] (IO-487) SafeObjectInputStream contribution - restrict which classes can be deserialized

[ https://issues.apache.org/jira/browse/IO-487?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ] Bertrand Delacretaz updated IO-487: --- Attachment: IO-487-accept-reject-2.patch Here's an updated {{IO-487-accept-reject-2.patch}} that a

[jira] [Updated] (IO-487) SafeObjectInputStream contribution - restrict which classes can be deserialized

[ https://issues.apache.org/jira/browse/IO-487?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ] Adrian Crum updated IO-487: --- Attachment: IO-487.patch Updated patch with Niall's changes. The biggest problem I see with this issue is we have

[jira] [Updated] (IO-487) SafeObjectInputStream contribution - restrict which classes can be deserialized

[ https://issues.apache.org/jira/browse/IO-487?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ] Bertrand Delacretaz updated IO-487: --- Attachment: IO-487-accept-reject.patch Here's IO-487-accept-reject.patch with the suggested accept

[jira] [Updated] (IO-487) SafeObjectInputStream contribution - restrict which classes can be deserialized

[ https://issues.apache.org/jira/browse/IO-487?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ] Bertrand Delacretaz updated IO-487: --- Attachment: IO-487-matchers.patch Based on all those great ideas, here's a variant (IO-487-matcher

[jira] [Updated] (IO-487) SafeObjectInputStream contribution - restrict which classes can be deserialized

[ https://issues.apache.org/jira/browse/IO-487?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ] Niall Pemberton updated IO-487: --- Attachment: IO-487-2.patch Attaching IO-487-2.patch which includes the following: * Change the ClassAccep

[jira] [Updated] (IO-487) SafeObjectInputStream contribution - restrict which classes can be deserialized

[ https://issues.apache.org/jira/browse/IO-487?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ] Adrian Crum updated IO-487: --- Attachment: IO-487.patch Latest patch with the new class names. I'm still working on the unit tests. I can't get

[jira] [Updated] (IO-487) SafeObjectInputStream contribution - restrict which classes can be deserialized

[ https://issues.apache.org/jira/browse/IO-487?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ] Niall Pemberton updated IO-487: --- Attachment: IO-487-name-regex-acceptor.patch An alternative would be for single RegexClassAcceptor & NameC

[jira] [Updated] (IO-487) SafeObjectInputStream contribution - restrict which classes can be deserialized

[ https://issues.apache.org/jira/browse/IO-487?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ] Adrian Crum updated IO-487: --- Attachment: IO-487.patch Updated patch that includes the suggestions made so far. I think the latest API is flexi

[jira] [Updated] (IO-487) SafeObjectInputStream contribution - restrict which classes can be deserialized

[ https://issues.apache.org/jira/browse/IO-487?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ] Adrian Crum updated IO-487: --- Attachment: IO-487.patch Improved patch attached. Added missing @Overrides, added missing JavaDocs, added more Cl

[jira] [Updated] (IO-487) SafeObjectInputStream contribution - restrict which classes can be deserialized

[ https://issues.apache.org/jira/browse/IO-487?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ] Bertrand Delacretaz updated IO-487: --- Attachment: IO-487.patch Another update...just a comment change. > SafeObjectInputStream contribu

[jira] [Updated] (IO-487) SafeObjectInputStream contribution - restrict which classes can be deserialized

[ https://issues.apache.org/jira/browse/IO-487?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ] Bertrand Delacretaz updated IO-487: --- Attachment: IO-487.patch Here's an updated patch that uses UnsupportedOperationException, good ide

[jira] [Updated] (IO-487) SafeObjectInputStream contribution - restrict which classes can be deserialized

[ https://issues.apache.org/jira/browse/IO-487?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ] Bertrand Delacretaz updated IO-487: --- Attachment: IO-487.patch > SafeObjectInputStream contribution - restrict which classes can be > d