Class ValidatingObjectInputStream

java.lang.Object
java.io.InputStream
java.io.ObjectInputStream
org.apache.commons.io.serialization.ValidatingObjectInputStream
All Implemented Interfaces:
Closeable, DataInput, ObjectInput, ObjectStreamConstants, AutoCloseable

public class ValidatingObjectInputStream extends ObjectInputStream
An ObjectInputStream that's restricted to deserialize a limited set of classes.

Various accept/reject methods allow for specifying which classes can be deserialized.

Design inspired by IBM DeveloperWorks Article.

  • Field Details

  • Constructor Details

    • ValidatingObjectInputStream

      public ValidatingObjectInputStream(InputStream input) throws IOException
      Constructs an object to deserialize the specified input stream. At least one accept method needs to be called to specify which classes can be deserialized, as by default no classes are accepted.
      Parameters:
      input - an input stream
      Throws:
      IOException - if an I/O error occurs while reading stream header
  • Method Details

    • validateClassName

      private void validateClassName(String name) throws InvalidClassException
      Check that the classname conforms to requirements.
      Parameters:
      name - The class name
      Throws:
      InvalidClassException - when a non-accepted class is encountered
    • invalidClassNameFound

      protected void invalidClassNameFound(String className) throws InvalidClassException
      Called to throw InvalidClassException if an invalid class name is found during deserialization. Can be overridden, for example to log those class names.
      Parameters:
      className - name of the invalid class
      Throws:
      InvalidClassException - if the specified class is not allowed
    • resolveClass

      protected Class<?> resolveClass(ObjectStreamClass osc) throws IOException, ClassNotFoundException
      Overrides:
      resolveClass in class ObjectInputStream
      Throws:
      IOException
      ClassNotFoundException
    • accept

      public ValidatingObjectInputStream accept(Class<?>... classes)
      Accept the specified classes for deserialization, unless they are otherwise rejected.
      Parameters:
      classes - Classes to accept
      Returns:
      this object
    • reject

      public ValidatingObjectInputStream reject(Class<?>... classes)
      Reject the specified classes for deserialization, even if they are otherwise accepted.
      Parameters:
      classes - Classes to reject
      Returns:
      this object
    • accept

      public ValidatingObjectInputStream accept(String... patterns)
      Accept the wildcard specified classes for deserialization, unless they are otherwise rejected.
      Parameters:
      patterns - Wildcard file name patterns as defined by FilenameUtils.wildcardMatch
      Returns:
      this object
    • reject

      public ValidatingObjectInputStream reject(String... patterns)
      Reject the wildcard specified classes for deserialization, even if they are otherwise accepted.
      Parameters:
      patterns - Wildcard file name patterns as defined by FilenameUtils.wildcardMatch
      Returns:
      this object
    • accept

      public ValidatingObjectInputStream accept(Pattern pattern)
      Accept class names that match the supplied pattern for deserialization, unless they are otherwise rejected.
      Parameters:
      pattern - standard Java regexp
      Returns:
      this object
    • reject

      public ValidatingObjectInputStream reject(Pattern pattern)
      Reject class names that match the supplied pattern for deserialization, even if they are otherwise accepted.
      Parameters:
      pattern - standard Java regexp
      Returns:
      this object
    • accept

      Accept class names where the supplied ClassNameMatcher matches for deserialization, unless they are otherwise rejected.
      Parameters:
      m - the matcher to use
      Returns:
      this object
    • reject

      Reject class names where the supplied ClassNameMatcher matches for deserialization, even if they are otherwise accepted.
      Parameters:
      m - the matcher to use
      Returns:
      this object