public class HardenedObjectInputStream extends ObjectInputStream
It is assumed that classes in the "java.lang" and "java.util" packages are always authorized.
ObjectInputStream.GetFieldbaseWireHandle, PROTOCOL_VERSION_1, PROTOCOL_VERSION_2, SC_BLOCK_DATA, SC_ENUM, SC_EXTERNALIZABLE, SC_SERIALIZABLE, SC_WRITE_METHOD, STREAM_MAGIC, STREAM_VERSION, SUBCLASS_IMPLEMENTATION_PERMISSION, SUBSTITUTION_PERMISSION, TC_ARRAY, TC_BASE, TC_BLOCKDATA, TC_BLOCKDATALONG, TC_CLASS, TC_CLASSDESC, TC_ENDBLOCKDATA, TC_ENUM, TC_EXCEPTION, TC_LONGSTRING, TC_MAX, TC_NULL, TC_OBJECT, TC_PROXYCLASSDESC, TC_REFERENCE, TC_RESET, TC_STRING| Constructor and Description |
|---|
HardenedObjectInputStream(InputStream in,
List<String> whitelist) |
HardenedObjectInputStream(InputStream in,
String[] whilelist) |
| Modifier and Type | Method and Description |
|---|---|
protected void |
addToWhitelist(List<String> additionalAuthorizedClasses) |
protected Class<?> |
resolveClass(ObjectStreamClass anObjectStreamClass) |
available, close, defaultReadObject, enableResolveObject, read, read, readBoolean, readByte, readChar, readClassDescriptor, readDouble, readFields, readFloat, readFully, readFully, readInt, readLine, readLong, readObject, readObjectOverride, readShort, readStreamHeader, readUnshared, readUnsignedByte, readUnsignedShort, readUTF, registerValidation, resolveObject, resolveProxyClass, skipBytesmark, markSupported, read, reset, skipclone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, waitread, skippublic HardenedObjectInputStream(InputStream in, String[] whilelist) throws IOException
IOExceptionpublic HardenedObjectInputStream(InputStream in, List<String> whitelist) throws IOException
IOExceptionprotected Class<?> resolveClass(ObjectStreamClass anObjectStreamClass) throws IOException, ClassNotFoundException
resolveClass in class ObjectInputStreamIOExceptionClassNotFoundException