Package org.apache.geode.modules.util

Class ClassLoaderObjectInputStream

java.lang.Object

java.io.InputStream

java.io.ObjectInputStream

org.apache.geode.modules.util.ClassLoaderObjectInputStream

All Implemented Interfaces:

Closeable, DataInput, ObjectInput, ObjectStreamConstants, AutoCloseable

public class ClassLoaderObjectInputStream
extends ObjectInputStream

This class is used when session attributes need to be reconstructed with a new classloader. It now supports ObjectInputFilter for secure deserialization.

Nested Class Summary

Nested classes/interfaces inherited from class java.io.ObjectInputStream

ObjectInputStream.GetField

Field Summary

Fields inherited from interface java.io.ObjectStreamConstants

baseWireHandle, PROTOCOL_VERSION_1, PROTOCOL_VERSION_2, SC_BLOCK_DATA, SC_ENUM, SC_EXTERNALIZABLE, SC_SERIALIZABLE, SC_WRITE_METHOD, SERIAL_FILTER_PERMISSION, STREAM_MAGIC, STREAM_VERSION, SUBCLASS_IMPLEMENTATION_PERMISSION, SUBSTITUTION_PERMISSION, TC_ARRAY, TC_BASE, TC_BLOCKDATA, TC_BLOCKDATALONG, TC_CLASS, TC_CLASSDESC, TC_ENDBLOCKDATA, TC_ENUM, TC_EXCEPTION, TC_LONGSTRING, TC_MAX, TC_NULL, TC_OBJECT, TC_PROXYCLASSDESC, TC_REFERENCE, TC_RESET, TC_STRING

Constructor Summary

Constructors

Constructor	Description
ClassLoaderObjectInputStream(InputStream in, ClassLoader loader)	Deprecated. Use ClassLoaderObjectInputStream(InputStream, ClassLoader, ObjectInputFilter) with a filter for secure deserialization
ClassLoaderObjectInputStream(InputStream in, ClassLoader loader, ObjectInputFilter filter)	Constructs a ClassLoaderObjectInputStream with an ObjectInputFilter for secure deserialization.

Method Summary

Modifier and Type	Method	Description
Class<?>	resolveClass(ObjectStreamClass desc)

Methods inherited from class java.io.ObjectInputStream

available, close, defaultReadObject, enableResolveObject, getObjectInputFilter, read, read, readBoolean, readByte, readChar, readClassDescriptor, readDouble, readFields, readFloat, readFully, readFully, readInt, readLine, readLong, readObject, readObjectOverride, readShort, readStreamHeader, readUnshared, readUnsignedByte, readUnsignedShort, readUTF, registerValidation, resolveObject, resolveProxyClass, setObjectInputFilter, skipBytes

Methods inherited from class java.io.InputStream

mark, markSupported, nullInputStream, read, readAllBytes, readNBytes, readNBytes, reset, skip, skipNBytes, transferTo

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Methods inherited from interface java.io.ObjectInput

read, skip

Constructor Details

ClassLoaderObjectInputStream

public ClassLoaderObjectInputStream(InputStream in,
 ClassLoader loader,
 ObjectInputFilter filter)
                             throws IOException

Constructs a ClassLoaderObjectInputStream with an ObjectInputFilter for secure deserialization.

Parameters:

in - the input stream to read from

loader - the ClassLoader to use for class resolution

filter - the ObjectInputFilter to validate deserialized classes (required for security)

Throws:

IOException - if an I/O error occurs

ClassLoaderObjectInputStream

@Deprecated
public ClassLoaderObjectInputStream(InputStream in,
 ClassLoader loader)
                             throws IOException

Deprecated.

Use ClassLoaderObjectInputStream(InputStream, ClassLoader, ObjectInputFilter) with a filter for secure deserialization

Legacy constructor for backward compatibility.

Throws:

IOException

Method Details

resolveClass

public Class<?> resolveClass(ObjectStreamClass desc)
                      throws ClassNotFoundException

Overrides:

resolveClass in class ObjectInputStream

Throws:

ClassNotFoundException