Class FilteredObjectInputStream

java.lang.Object

java.io.InputStream

java.io.ObjectInputStream

org.apache.logging.log4j.util.FilteredObjectInputStream

All Implemented Interfaces:

Closeable, DataInput, ObjectInput, ObjectStreamConstants, AutoCloseable

public class FilteredObjectInputStream
extends ObjectInputStream

Extends ObjectInputStream to only allow some built-in Log4j classes and caller-specified classes to be deserialized.

Since:

2.8.2

Nested Class Summary

Nested classes/interfaces inherited from class ObjectInputStream

ObjectInputStream.GetField

Field Summary

Fields

Modifier and Type	Field	Description
private final Collection<String>	allowedExtraClasses
private static final Set<String>	REQUIRED_JAVA_CLASSES
private static final Set<String>	REQUIRED_JAVA_PACKAGES

Fields inherited from interface ObjectStreamConstants

baseWireHandle, PROTOCOL_VERSION_1, PROTOCOL_VERSION_2, SC_BLOCK_DATA, SC_ENUM, SC_EXTERNALIZABLE, SC_SERIALIZABLE, SC_WRITE_METHOD, SERIAL_FILTER_PERMISSION, STREAM_MAGIC, STREAM_VERSION, SUBCLASS_IMPLEMENTATION_PERMISSION, SUBSTITUTION_PERMISSION, TC_ARRAY, TC_BASE, TC_BLOCKDATA, TC_BLOCKDATALONG, TC_CLASS, TC_CLASSDESC, TC_ENDBLOCKDATA, TC_ENUM, TC_EXCEPTION, TC_LONGSTRING, TC_MAX, TC_NULL, TC_OBJECT, TC_PROXYCLASSDESC, TC_REFERENCE, TC_RESET, TC_STRING

Constructor Summary

Constructors

Constructor	Description
FilteredObjectInputStream()
FilteredObjectInputStream(InputStream inputStream)
FilteredObjectInputStream(InputStream inputStream, Collection<String> allowedExtraClasses)
FilteredObjectInputStream(Collection<String> allowedExtraClasses)

Method Summary

Modifier and Type	Method	Description
Collection<String>	getAllowedClasses()
private static boolean	isAllowedByDefault(String name)
private static boolean	isRequiredPackage(String name)
protected Class<?>	resolveClass(ObjectStreamClass desc)

Methods inherited from class ObjectInputStream

available, close, defaultReadObject, enableResolveObject, getObjectInputFilter, read, read, readBoolean, readByte, readChar, readClassDescriptor, readDouble, readFields, readFloat, readFully, readFully, readInt, readLine, readLong, readObject, readObjectOverride, readShort, readStreamHeader, readUnshared, readUnsignedByte, readUnsignedShort, readUTF, registerValidation, resolveObject, resolveProxyClass, setObjectInputFilter, skipBytes

Methods inherited from class InputStream

mark, markSupported, nullInputStream, read, readAllBytes, readNBytes, readNBytes, reset, skip, skipNBytes, transferTo

Methods inherited from class Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Methods inherited from interface ObjectInput

read, skip

Field Details

REQUIRED_JAVA_CLASSES

private static final Set<String> REQUIRED_JAVA_CLASSES

REQUIRED_JAVA_PACKAGES

private static final Set<String> REQUIRED_JAVA_PACKAGES

allowedExtraClasses

private final Collection<String> allowedExtraClasses

Constructor Details

FilteredObjectInputStream

public FilteredObjectInputStream()
                          throws IOException,
SecurityException

Throws:

IOException

SecurityException

FilteredObjectInputStream

public FilteredObjectInputStream(InputStream inputStream)
                          throws IOException

Throws:

IOException

FilteredObjectInputStream

public FilteredObjectInputStream(Collection<String> allowedExtraClasses)
                          throws IOException,
SecurityException

Throws:

IOException

SecurityException

FilteredObjectInputStream

public FilteredObjectInputStream(InputStream inputStream,
 Collection<String> allowedExtraClasses)
                          throws IOException

Throws:

IOException

Method Details

getAllowedClasses

public Collection<String> getAllowedClasses()

resolveClass

protected Class<?> resolveClass(ObjectStreamClass desc)
                         throws IOException,
ClassNotFoundException

Overrides:

resolveClass in class ObjectInputStream

Throws:

IOException

ClassNotFoundException

isAllowedByDefault

private static boolean isAllowedByDefault(String name)

isRequiredPackage

private static boolean isRequiredPackage(String name)