org.apache.commons.io.serialization

类 ValidatingObjectInputStream

java.lang.Object

java.io.InputStream

java.io.ObjectInputStream

org.apache.commons.io.serialization.ValidatingObjectInputStream

所有已实现的接口:

Closeable, DataInput, ObjectInput, ObjectStreamConstants, AutoCloseable

public class ValidatingObjectInputStream
extends ObjectInputStream

An ObjectInputStream that's restricted to deserialize a limited set of classes.

Various accept/reject methods allow for specifying which classes can be deserialized.

Design inspired by IBM DeveloperWorks Article.

嵌套类概要

从类继承的嵌套类/接口 java.io.ObjectInputStream

ObjectInputStream.GetField

字段概要

从接口继承的字段 java.io.ObjectStreamConstants

baseWireHandle, PROTOCOL_VERSION_1, PROTOCOL_VERSION_2, SC_BLOCK_DATA, SC_ENUM, SC_EXTERNALIZABLE, SC_SERIALIZABLE, SC_WRITE_METHOD, STREAM_MAGIC, STREAM_VERSION, SUBCLASS_IMPLEMENTATION_PERMISSION, SUBSTITUTION_PERMISSION, TC_ARRAY, TC_BASE, TC_BLOCKDATA, TC_BLOCKDATALONG, TC_CLASS, TC_CLASSDESC, TC_ENDBLOCKDATA, TC_ENUM, TC_EXCEPTION, TC_LONGSTRING, TC_MAX, TC_NULL, TC_OBJECT, TC_PROXYCLASSDESC, TC_REFERENCE, TC_RESET, TC_STRING

构造器概要

构造器

构造器和说明
ValidatingObjectInputStream(InputStream input) Constructs an object to deserialize the specified input stream.

方法概要

限定符和类型	方法和说明
ValidatingObjectInputStream	accept(Class<?>... classes) Accept the specified classes for deserialization, unless they are otherwise rejected.
ValidatingObjectInputStream	accept(ClassNameMatcher m) Accept class names where the supplied ClassNameMatcher matches for deserialization, unless they are otherwise rejected.
ValidatingObjectInputStream	accept(Pattern pattern) Accept class names that match the supplied pattern for deserialization, unless they are otherwise rejected.
ValidatingObjectInputStream	accept(String... patterns) Accept the wildcard specified classes for deserialization, unless they are otherwise rejected.
protected void	invalidClassNameFound(String className) Called to throw InvalidClassException if an invalid class name is found during deserialization.
ValidatingObjectInputStream	reject(Class<?>... classes) Reject the specified classes for deserialization, even if they are otherwise accepted.
ValidatingObjectInputStream	reject(ClassNameMatcher m) Reject class names where the supplied ClassNameMatcher matches for deserialization, even if they are otherwise accepted.
ValidatingObjectInputStream	reject(Pattern pattern) Reject class names that match the supplied pattern for deserialization, even if they are otherwise accepted.
ValidatingObjectInputStream	reject(String... patterns) Reject the wildcard specified classes for deserialization, even if they are otherwise accepted.
protected Class<?>	resolveClass(ObjectStreamClass osc)

从类继承的方法 java.io.ObjectInputStream

available, close, defaultReadObject, enableResolveObject, read, read, readBoolean, readByte, readChar, readClassDescriptor, readDouble, readFields, readFloat, readFully, readFully, readInt, readLine, readLong, readObject, readObjectOverride, readShort, readStreamHeader, readUnshared, readUnsignedByte, readUnsignedShort, readUTF, registerValidation, resolveObject, resolveProxyClass, skipBytes

从类继承的方法 java.io.InputStream

mark, markSupported, read, reset, skip

从类继承的方法 java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

从接口继承的方法 java.io.ObjectInput

read, skip

构造器详细资料

ValidatingObjectInputStream

public ValidatingObjectInputStream(InputStream input)
                            throws IOException

Constructs an object to deserialize the specified input stream. At least one accept method needs to be called to specify which classes can be deserialized, as by default no classes are accepted.

参数:

input - an input stream

抛出:

IOException - if an I/O error occurs while reading stream header

方法详细资料

invalidClassNameFound

protected void invalidClassNameFound(String className)
                              throws InvalidClassException

Called to throw InvalidClassException if an invalid class name is found during deserialization. Can be overridden, for example to log those class names.

参数:

className - name of the invalid class

抛出:

InvalidClassException - if the specified class is not allowed

resolveClass

protected Class<?> resolveClass(ObjectStreamClass osc)
                         throws IOException,
                                ClassNotFoundException

覆盖:

resolveClass 在类中 ObjectInputStream

抛出:

IOException

ClassNotFoundException

accept

public ValidatingObjectInputStream accept(Class<?>... classes)

Accept the specified classes for deserialization, unless they are otherwise rejected.

参数:

classes - Classes to accept

返回:

this object

reject

public ValidatingObjectInputStream reject(Class<?>... classes)

Reject the specified classes for deserialization, even if they are otherwise accepted.

参数:

classes - Classes to reject

返回:

this object

accept

public ValidatingObjectInputStream accept(String... patterns)

Accept the wildcard specified classes for deserialization, unless they are otherwise rejected.

参数:

patterns - Wildcard filename patterns as defined by FilenameUtils.wildcardMatch

返回:

this object

reject

public ValidatingObjectInputStream reject(String... patterns)

Reject the wildcard specified classes for deserialization, even if they are otherwise accepted.

参数:

patterns - Wildcard filename patterns as defined by FilenameUtils.wildcardMatch

返回:

this object

accept

public ValidatingObjectInputStream accept(Pattern pattern)

Accept class names that match the supplied pattern for deserialization, unless they are otherwise rejected.

参数:

pattern - standard Java regexp

返回:

this object

reject

public ValidatingObjectInputStream reject(Pattern pattern)

Reject class names that match the supplied pattern for deserialization, even if they are otherwise accepted.

参数:

pattern - standard Java regexp

返回:

this object

accept

public ValidatingObjectInputStream accept(ClassNameMatcher m)

Accept class names where the supplied ClassNameMatcher matches for deserialization, unless they are otherwise rejected.

参数:

m - the matcher to use

返回:

this object

reject

public ValidatingObjectInputStream reject(ClassNameMatcher m)

Reject class names where the supplied ClassNameMatcher matches for deserialization, even if they are otherwise accepted.

参数:

m - the matcher to use

返回:

this object