org.springframework.integration.support.converter

Class WhiteListDeserializingConverter

java.lang.Object

org.springframework.integration.support.converter.WhiteListDeserializingConverter

All Implemented Interfaces:

org.springframework.core.convert.converter.Converter<byte[],java.lang.Object>

public class WhiteListDeserializingConverter
extends java.lang.Object
implements org.springframework.core.convert.converter.Converter<byte[],java.lang.Object>

A Converter that delegates to a Deserializer to convert data in a byte array to an object. By default, if using a DefaultDeserializer all classes/packages are deserialized. If you receive data from untrusted sources, consider adding trusted classes/packages using setWhiteListPatterns(String...) or addWhiteListPatterns(String...).

Since:

4.2.13

Constructor Summary

Constructors

Constructor and Description
WhiteListDeserializingConverter() Create a WhiteListDeserializingConverter with default ObjectInputStream configuration, using the "latest user-defined ClassLoader".
WhiteListDeserializingConverter(java.lang.ClassLoader classLoader) Create a WhiteListDeserializingConverter for using an ObjectInputStream with the given ClassLoader.
WhiteListDeserializingConverter(org.springframework.core.serializer.Deserializer<java.lang.Object> deserializer) Create a WhiteListDeserializingConverter that delegates to the provided Deserializer.

Method Summary

Modifier and Type	Method and Description
void	addWhiteListPatterns(java.lang.String... patterns) Add package/class patterns to the white list.
protected void	checkWhiteList(java.lang.Class<?> clazz)
java.lang.Object	convert(byte[] source)
protected java.lang.Object	deserialize(java.io.ByteArrayInputStream inputStream)
void	setWhiteListPatterns(java.lang.String... whiteListPatterns) Set simple patterns for allowable packages/classes for deserialization.

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Constructor Detail

WhiteListDeserializingConverter

public WhiteListDeserializingConverter()

Create a WhiteListDeserializingConverter with default ObjectInputStream configuration, using the "latest user-defined ClassLoader".

WhiteListDeserializingConverter

public WhiteListDeserializingConverter(java.lang.ClassLoader classLoader)

Create a WhiteListDeserializingConverter for using an ObjectInputStream with the given ClassLoader.

Parameters:

classLoader - the class loader to use for deserialization.

WhiteListDeserializingConverter

public WhiteListDeserializingConverter(org.springframework.core.serializer.Deserializer<java.lang.Object> deserializer)

Create a WhiteListDeserializingConverter that delegates to the provided Deserializer.

Parameters:

deserializer - the deserializer to use.

Method Detail

setWhiteListPatterns

public void setWhiteListPatterns(java.lang.String... whiteListPatterns)

Set simple patterns for allowable packages/classes for deserialization. The patterns will be applied in order until a match is found. A class can be fully qualified or a wildcard '*' is allowed at the beginning or end of the class name. Examples: com.foo.*, *.MyClass.

Parameters:

whiteListPatterns - the patterns.

addWhiteListPatterns

public void addWhiteListPatterns(java.lang.String... patterns)

Add package/class patterns to the white list.

Parameters:

patterns - the patterns to add.

See Also:

setWhiteListPatterns(String...)

convert

public java.lang.Object convert(byte[] source)

Specified by:

convert in interface org.springframework.core.convert.converter.Converter<byte[],java.lang.Object>

deserialize

protected java.lang.Object deserialize(java.io.ByteArrayInputStream inputStream)
                                throws java.io.IOException

Throws:

java.io.IOException

checkWhiteList

protected void checkWhiteList(java.lang.Class<?> clazz)
                       throws java.io.IOException

Throws:

java.io.IOException