Module is.codion.common.rmi

Package is.codion.common.rmi.server

Class SerializationFilterFactory

java.lang.Object

is.codion.common.rmi.server.SerializationFilterFactory

All Implemented Interfaces:

ObjectInputFilterFactory

public final class SerializationFilterFactory
extends Object
implements ObjectInputFilterFactory

A ObjectInputFilterFactory implementation based on patterns, specified as a string via SERIALIZATION_FILTER_PATTERNS or from a file via SERIALIZATION_FILTER_PATTERN_FILE.

See Java Serialization Filters and JEP 290: Filter Incoming Serialization Data

Field Summary

Fields

Modifier and Type	Field	Description
static final PropertyValue<String>	SERIALIZATION_FILTER_DRYRUN_FILE	If specified then a list of all deserialized classes is written to the given file on server shutdown.
static final PropertyValue<Integer>	SERIALIZATION_FILTER_DRYRUN_FLUSH_INTERVAL	The interval in seconds for periodically flushing the dry-run output to disk.
static final PropertyValue<Integer>	SERIALIZATION_FILTER_MAX_ARRAY	The maximum array size allowed to prevent resource exhaustion attacks.
static final PropertyValue<Long>	SERIALIZATION_FILTER_MAX_BYTES	The maximum number of bytes in the input stream to prevent resource exhaustion attacks.
static final PropertyValue<Integer>	SERIALIZATION_FILTER_MAX_DEPTH	The maximum depth of the object graph to prevent resource exhaustion attacks.
static final PropertyValue<Integer>	SERIALIZATION_FILTER_MAX_REFS	The maximum number of object references to prevent resource exhaustion attacks.
static final PropertyValue<String>	SERIALIZATION_FILTER_PATTERN_FILE	The path to the serialization pattern file to use.
static final PropertyValue<String>	SERIALIZATION_FILTER_PATTERNS	The serialization patterns to use.

Constructor Summary

Constructors

Constructor	Description
SerializationFilterFactory()

Method Summary

Modifier and Type	Method	Description
ObjectInputFilter	createObjectInputFilter()

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Field Details

SERIALIZATION_FILTER_PATTERNS

public static final PropertyValue<String> SERIALIZATION_FILTER_PATTERNS

The serialization patterns to use.

Is overridden by SERIALIZATION_FILTER_PATTERNS.

SERIALIZATION_FILTER_PATTERN_FILE

public static final PropertyValue<String> SERIALIZATION_FILTER_PATTERN_FILE

The path to the serialization pattern file to use.

Supports 'classpath:' prefix for a pattern file in the classpath root.

SERIALIZATION_FILTER_DRYRUN_FILE

public static final PropertyValue<String> SERIALIZATION_FILTER_DRYRUN_FILE

If specified then a list of all deserialized classes is written to the given file on server shutdown. Note this overwrites the file if it already exists.

SERIALIZATION_FILTER_DRYRUN_FLUSH_INTERVAL

public static final PropertyValue<Integer> SERIALIZATION_FILTER_DRYRUN_FLUSH_INTERVAL

The interval in seconds for periodically flushing the dry-run output to disk.

• Value type: Integer
• Default value: 30

SERIALIZATION_FILTER_MAX_BYTES

public static final PropertyValue<Long> SERIALIZATION_FILTER_MAX_BYTES

The maximum number of bytes in the input stream to prevent resource exhaustion attacks.

• Value type: Long
• Default value: 10.485.760 (10 MB)

SERIALIZATION_FILTER_MAX_ARRAY

public static final PropertyValue<Integer> SERIALIZATION_FILTER_MAX_ARRAY

The maximum array size allowed to prevent resource exhaustion attacks.

• Value type: Integer
• Default value: 100.000

SERIALIZATION_FILTER_MAX_DEPTH

public static final PropertyValue<Integer> SERIALIZATION_FILTER_MAX_DEPTH

The maximum depth of the object graph to prevent resource exhaustion attacks.

• Value type: Integer
• Default value: 100

SERIALIZATION_FILTER_MAX_REFS

public static final PropertyValue<Integer> SERIALIZATION_FILTER_MAX_REFS

The maximum number of object references to prevent resource exhaustion attacks.

• Value type: Integer
• Default value: 1.000.000

Constructor Details

SerializationFilterFactory

public SerializationFilterFactory()

Method Details

createObjectInputFilter

public ObjectInputFilter createObjectInputFilter()

Specified by:

createObjectInputFilter in interface ObjectInputFilterFactory

Returns:

a ObjectInputFilter instance