stan/jdk-24
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

8202675: Replace process-wide terminology in serial filtering to be consistent

Browse Source 
Reviewed-by: alanb, lancea
This commit is contained in:
Roger Riggs 2019-01-15 15:56:41 -05:00
parent 045cf9733d
commit 0ec2218c50
4 changed files with 23 additions and 23 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

26
src/java.base/share/classes/java/io/ObjectInputFilter.java
View File

@ -1,5 +1,5 @@
/*
* Copyright (c) 2016, 2018, Oracle and/or its affiliates. All rights reserved.
* Copyright (c) 2016, 2019, Oracle and/or its affiliates. All rights reserved.
* DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
*
* This code is free software; you can redistribute it and/or modify it
@ -72,7 +72,7 @@ import jdk.internal.access.SharedSecrets;
* to use other filters without forcing either allowed or rejected status.
*
* <p>
* Typically, a custom filter should check if a process-wide filter
* Typically, a custom filter should check if a system-wide filter
* is configured and defer to it if so. For example,
* <pre>{@code
* ObjectInputFilter.Status checkInput(FilterInfo info) {
@ -80,7 +80,7 @@ import jdk.internal.access.SharedSecrets;
* if (serialFilter != null) {
* ObjectInputFilter.Status status = serialFilter.checkInput(info);
* if (status != ObjectInputFilter.Status.UNDECIDED) {
* // The process-wide filter overrides this filter
* // The system-wide filter overrides this filter
* return status;
* }
* }
@ -196,8 +196,8 @@ public interface ObjectInputFilter {
}
/**
* A utility class to set and get the process-wide filter or create a filter
* from a pattern string. If a process-wide filter is set, it will be
* A utility class to set and get the system-wide filter or create a filter
* from a pattern string. If a system-wide filter is set, it will be
* used for each {@link ObjectInputStream} that does not set its own filter.
* <p>
* When setting the filter, it should be stateless and idempotent,
@ -222,7 +222,7 @@ public interface ObjectInputFilter {
private Config() {}
/**
* Lock object for process-wide filter.
* Lock object for system-wide filter.
*/
private final static Object serialFilterLock = new Object();
@ -241,13 +241,13 @@ public interface ObjectInputFilter {
}
/**
* The name for the process-wide deserialization filter.
* The name for the system-wide deserialization filter.
* Used as a system property and a java.security.Security property.
*/
private final static String SERIAL_FILTER_PROPNAME = "jdk.serialFilter";
/**
* The process-wide filter; may be null.
* The system-wide filter; may be null.
* Lookup the filter in java.security.Security or
* the system property.
*/
@ -286,9 +286,9 @@ public interface ObjectInputFilter {
private static ObjectInputFilter serialFilter = configuredFilter;
/**
* Returns the process-wide serialization filter or {@code null} if not configured.
* Returns the system-wide serialization filter or {@code null} if not configured.
*
* @return the process-wide serialization filter or {@code null} if not configured
* @return the system-wide serialization filter or {@code null} if not configured
*/
public static ObjectInputFilter getSerialFilter() {
synchronized (serialFilterLock) {
@ -297,9 +297,9 @@ public interface ObjectInputFilter {
}
/**
* Set the process-wide filter if it has not already been configured or set.
* Set the system-wide filter if it has not already been configured or set.
*
* @param filter the serialization filter to set as the process-wide filter; not null
* @param filter the serialization filter to set as the system-wide filter; not null
* @throws SecurityException if there is security manager and the
* {@code SerializablePermission("serialFilter")} is not granted
* @throws IllegalStateException if the filter has already been set {@code non-null}
@ -401,7 +401,7 @@ public interface ObjectInputFilter {
/**
* Implementation of ObjectInputFilter that performs the checks of
* the process-wide serialization filter. If configured, it will be
* the system-wide serialization filter. If configured, it will be
* used for all ObjectInputStreams that do not set their own filters.
*
*/

14
src/java.base/share/classes/java/io/ObjectInputStream.java
View File

@ -1,5 +1,5 @@
/*
* Copyright (c) 1996, 2018, Oracle and/or its affiliates. All rights reserved.
* Copyright (c) 1996, 2019, Oracle and/or its affiliates. All rights reserved.
* DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
*
* This code is free software; you can redistribute it and/or modify it
@ -188,7 +188,7 @@ import sun.reflect.misc.ReflectUtil;
* the classes, array lengths, number of references in the stream, depth, and
* number of bytes consumed from the input stream are allowed and
* if not, can terminate deserialization.
* A {@linkplain ObjectInputFilter.Config#setSerialFilter(ObjectInputFilter) process-wide filter}
* A {@linkplain ObjectInputFilter.Config#setSerialFilter(ObjectInputFilter) system-wide filter}
* can be configured that is applied to each {@code ObjectInputStream} unless replaced
* using {@link #setObjectInputFilter(ObjectInputFilter) setObjectInputFilter}.
*
@ -322,7 +322,7 @@ public class ObjectInputStream
* has written and flushed the header.
*
* <p>The serialization filter is initialized to the value of
* {@linkplain ObjectInputFilter.Config#getSerialFilter() the process-wide filter}.
* {@linkplain ObjectInputFilter.Config#getSerialFilter() the system-wide filter}.
*
* <p>If a security manager is installed, this constructor will check for
* the "enableSubclassImplementation" SerializablePermission when invoked
@ -357,7 +357,7 @@ public class ObjectInputStream
* implementation of ObjectInputStream.
*
* <p>The serialization filter is initialized to the value of
* {@linkplain ObjectInputFilter.Config#getSerialFilter() the process-wide filter}.
* {@linkplain ObjectInputFilter.Config#getSerialFilter() the system-wide filter}.
*
* <p>If there is a security manager installed, this method first calls the
* security manager's <code>checkPermission</code> method with the
@ -1157,7 +1157,7 @@ public class ObjectInputStream
* Returns the serialization filter for this stream.
* The serialization filter is the most recent filter set in
* {@link #setObjectInputFilter setObjectInputFilter} or
* the initial process-wide filter from
* the initial system-wide filter from
* {@link ObjectInputFilter.Config#getSerialFilter() ObjectInputFilter.Config.getSerialFilter}.
*
* @return the serialization filter for the stream; may be null
@ -1233,7 +1233,7 @@ public class ObjectInputStream
* @throws SecurityException if there is security manager and the
* {@code SerializablePermission("serialFilter")} is not granted
* @throws IllegalStateException if the {@linkplain #getObjectInputFilter() current filter}
* is not {@code null} and is not the process-wide filter
* is not {@code null} and is not the system-wide filter
* @since 9
*/
public final void setObjectInputFilter(ObjectInputFilter filter) {
@ -1241,7 +1241,7 @@ public class ObjectInputStream
if (sm != null) {
sm.checkPermission(ObjectStreamConstants.SERIAL_FILTER_PERMISSION);
}
// Allow replacement of the process-wide filter if not already set
// Allow replacement of the system-wide filter if not already set
if (serialFilter != null &&
serialFilter != ObjectInputFilter.Config.getSerialFilter()) {
throw new IllegalStateException("filter can not be set more than once");

4
src/java.base/share/classes/java/io/ObjectStreamConstants.java
View File

@ -1,5 +1,5 @@
/*
* Copyright (c) 1996, 2013, Oracle and/or its affiliates. All rights reserved.
* Copyright (c) 1996, 2019, Oracle and/or its affiliates. All rights reserved.
* DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
*
* This code is free software; you can redistribute it and/or modify it
@ -201,7 +201,7 @@ public interface ObjectStreamConstants {
new SerializablePermission("enableSubclassImplementation");
/**
* Enable setting the process-wide serial filter.
* Enable setting the system-wide serial filter.
*
* @see java.io.ObjectInputFilter.Config#setSerialFilter(ObjectInputFilter)
* @since 9

2
src/java.base/share/conf/security/java.security
View File

@ -920,7 +920,7 @@ jdk.xml.dsig.secureValidationPolicy=\
noRetrievalMethodLoops
#
# Serialization process-wide filter
# Serialization system-wide filter
#
# A filter, if configured, is used by java.io.ObjectInputStream during
# deserialization to check the contents of the stream.