stan/jdk-24
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

8202675: Replace process-wide terminology in serial filtering to be consistent

Browse Source 
Reviewed-by: alanb, lancea
This commit is contained in:
Roger Riggs 2019-01-15 15:56:41 -05:00
parent 045cf9733d
commit 0ec2218c50
4 changed files with 23 additions and 23 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

26
src/java.base/share/classes/java/io/ObjectInputFilter.java
View File

@ -1,5 +1,5 @@
/* /*
* Copyright (c) 2016, 2018, Oracle and/or its affiliates. All rights reserved. * Copyright (c) 2016, 2019, Oracle and/or its affiliates. All rights reserved.
* DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER. * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
* *
* This code is free software; you can redistribute it and/or modify it * This code is free software; you can redistribute it and/or modify it
@ -72,7 +72,7 @@ import jdk.internal.access.SharedSecrets;
* to use other filters without forcing either allowed or rejected status. * to use other filters without forcing either allowed or rejected status.
* *
* <p> * <p>
* Typically, a custom filter should check if a process-wide filter * Typically, a custom filter should check if a system-wide filter
* is configured and defer to it if so. For example, * is configured and defer to it if so. For example,
* <pre>{@code * <pre>{@code
* ObjectInputFilter.Status checkInput(FilterInfo info) { * ObjectInputFilter.Status checkInput(FilterInfo info) {
@ -80,7 +80,7 @@ import jdk.internal.access.SharedSecrets;
* if (serialFilter != null) { * if (serialFilter != null) {
* ObjectInputFilter.Status status = serialFilter.checkInput(info); * ObjectInputFilter.Status status = serialFilter.checkInput(info);
* if (status != ObjectInputFilter.Status.UNDECIDED) { * if (status != ObjectInputFilter.Status.UNDECIDED) {
* // The process-wide filter overrides this filter * // The system-wide filter overrides this filter
* return status; * return status;
* } * }
* } * }
@ -196,8 +196,8 @@ public interface ObjectInputFilter {
} }
/** /**
* A utility class to set and get the process-wide filter or create a filter * A utility class to set and get the system-wide filter or create a filter
* from a pattern string. If a process-wide filter is set, it will be * from a pattern string. If a system-wide filter is set, it will be
* used for each {@link ObjectInputStream} that does not set its own filter. * used for each {@link ObjectInputStream} that does not set its own filter.
* <p> * <p>
* When setting the filter, it should be stateless and idempotent, * When setting the filter, it should be stateless and idempotent,
@ -222,7 +222,7 @@ public interface ObjectInputFilter {
private Config() {} private Config() {}
/** /**
* Lock object for process-wide filter. * Lock object for system-wide filter.
*/ */
private final static Object serialFilterLock = new Object(); private final static Object serialFilterLock = new Object();
@ -241,13 +241,13 @@ public interface ObjectInputFilter {
} }
/** /**
* The name for the process-wide deserialization filter. * The name for the system-wide deserialization filter.
* Used as a system property and a java.security.Security property. * Used as a system property and a java.security.Security property.
*/ */
private final static String SERIAL_FILTER_PROPNAME = "jdk.serialFilter"; private final static String SERIAL_FILTER_PROPNAME = "jdk.serialFilter";
/** /**
* The process-wide filter; may be null. * The system-wide filter; may be null.
* Lookup the filter in java.security.Security or * Lookup the filter in java.security.Security or
* the system property. * the system property.
*/ */
@ -286,9 +286,9 @@ public interface ObjectInputFilter {
private static ObjectInputFilter serialFilter = configuredFilter; private static ObjectInputFilter serialFilter = configuredFilter;
/** /**
* Returns the process-wide serialization filter or {@code null} if not configured. * Returns the system-wide serialization filter or {@code null} if not configured.
* *
* @return the process-wide serialization filter or {@code null} if not configured * @return the system-wide serialization filter or {@code null} if not configured
*/ */
public static ObjectInputFilter getSerialFilter() { public static ObjectInputFilter getSerialFilter() {
synchronized (serialFilterLock) { synchronized (serialFilterLock) {
@ -297,9 +297,9 @@ public interface ObjectInputFilter {
} }
/** /**
* Set the process-wide filter if it has not already been configured or set. * Set the system-wide filter if it has not already been configured or set.
* *
* @param filter the serialization filter to set as the process-wide filter; not null * @param filter the serialization filter to set as the system-wide filter; not null
* @throws SecurityException if there is security manager and the * @throws SecurityException if there is security manager and the
* {@code SerializablePermission("serialFilter")} is not granted * {@code SerializablePermission("serialFilter")} is not granted
* @throws IllegalStateException if the filter has already been set {@code non-null} * @throws IllegalStateException if the filter has already been set {@code non-null}
@ -401,7 +401,7 @@ public interface ObjectInputFilter {
/** /**
* Implementation of ObjectInputFilter that performs the checks of * Implementation of ObjectInputFilter that performs the checks of
* the process-wide serialization filter. If configured, it will be * the system-wide serialization filter. If configured, it will be
* used for all ObjectInputStreams that do not set their own filters. * used for all ObjectInputStreams that do not set their own filters.
* *
*/ */

14
src/java.base/share/classes/java/io/ObjectInputStream.java
View File

@ -1,5 +1,5 @@
/* /*
* Copyright (c) 1996, 2018, Oracle and/or its affiliates. All rights reserved. * Copyright (c) 1996, 2019, Oracle and/or its affiliates. All rights reserved.
* DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER. * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
* *
* This code is free software; you can redistribute it and/or modify it * This code is free software; you can redistribute it and/or modify it
@ -188,7 +188,7 @@ import sun.reflect.misc.ReflectUtil;
* the classes, array lengths, number of references in the stream, depth, and * the classes, array lengths, number of references in the stream, depth, and
* number of bytes consumed from the input stream are allowed and * number of bytes consumed from the input stream are allowed and
* if not, can terminate deserialization. * if not, can terminate deserialization.
* A {@linkplain ObjectInputFilter.Config#setSerialFilter(ObjectInputFilter) process-wide filter} * A {@linkplain ObjectInputFilter.Config#setSerialFilter(ObjectInputFilter) system-wide filter}
* can be configured that is applied to each {@code ObjectInputStream} unless replaced * can be configured that is applied to each {@code ObjectInputStream} unless replaced
* using {@link #setObjectInputFilter(ObjectInputFilter) setObjectInputFilter}. * using {@link #setObjectInputFilter(ObjectInputFilter) setObjectInputFilter}.
* *
@ -322,7 +322,7 @@ public class ObjectInputStream
* has written and flushed the header. * has written and flushed the header.
* *
* <p>The serialization filter is initialized to the value of * <p>The serialization filter is initialized to the value of
* {@linkplain ObjectInputFilter.Config#getSerialFilter() the process-wide filter}. * {@linkplain ObjectInputFilter.Config#getSerialFilter() the system-wide filter}.
* *
* <p>If a security manager is installed, this constructor will check for * <p>If a security manager is installed, this constructor will check for
* the "enableSubclassImplementation" SerializablePermission when invoked * the "enableSubclassImplementation" SerializablePermission when invoked
@ -357,7 +357,7 @@ public class ObjectInputStream
* implementation of ObjectInputStream. * implementation of ObjectInputStream.
* *
* <p>The serialization filter is initialized to the value of * <p>The serialization filter is initialized to the value of
* {@linkplain ObjectInputFilter.Config#getSerialFilter() the process-wide filter}. * {@linkplain ObjectInputFilter.Config#getSerialFilter() the system-wide filter}.
* *
* <p>If there is a security manager installed, this method first calls the * <p>If there is a security manager installed, this method first calls the
* security manager's <code>checkPermission</code> method with the * security manager's <code>checkPermission</code> method with the
@ -1157,7 +1157,7 @@ public class ObjectInputStream
* Returns the serialization filter for this stream. * Returns the serialization filter for this stream.
* The serialization filter is the most recent filter set in * The serialization filter is the most recent filter set in
* {@link #setObjectInputFilter setObjectInputFilter} or * {@link #setObjectInputFilter setObjectInputFilter} or
* the initial process-wide filter from * the initial system-wide filter from
* {@link ObjectInputFilter.Config#getSerialFilter() ObjectInputFilter.Config.getSerialFilter}. * {@link ObjectInputFilter.Config#getSerialFilter() ObjectInputFilter.Config.getSerialFilter}.
* *
* @return the serialization filter for the stream; may be null * @return the serialization filter for the stream; may be null
@ -1233,7 +1233,7 @@ public class ObjectInputStream
* @throws SecurityException if there is security manager and the * @throws SecurityException if there is security manager and the
* {@code SerializablePermission("serialFilter")} is not granted * {@code SerializablePermission("serialFilter")} is not granted
* @throws IllegalStateException if the {@linkplain #getObjectInputFilter() current filter} * @throws IllegalStateException if the {@linkplain #getObjectInputFilter() current filter}
* is not {@code null} and is not the process-wide filter * is not {@code null} and is not the system-wide filter
* @since 9 * @since 9
*/ */
public final void setObjectInputFilter(ObjectInputFilter filter) { public final void setObjectInputFilter(ObjectInputFilter filter) {
@ -1241,7 +1241,7 @@ public class ObjectInputStream
if (sm != null) { if (sm != null) {
sm.checkPermission(ObjectStreamConstants.SERIAL_FILTER_PERMISSION); sm.checkPermission(ObjectStreamConstants.SERIAL_FILTER_PERMISSION);
} }
// Allow replacement of the process-wide filter if not already set // Allow replacement of the system-wide filter if not already set
if (serialFilter != null && if (serialFilter != null &&
serialFilter != ObjectInputFilter.Config.getSerialFilter()) { serialFilter != ObjectInputFilter.Config.getSerialFilter()) {
throw new IllegalStateException("filter can not be set more than once"); throw new IllegalStateException("filter can not be set more than once");

4
src/java.base/share/classes/java/io/ObjectStreamConstants.java
View File

@ -1,5 +1,5 @@
/* /*
* Copyright (c) 1996, 2013, Oracle and/or its affiliates. All rights reserved. * Copyright (c) 1996, 2019, Oracle and/or its affiliates. All rights reserved.
* DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER. * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
* *
* This code is free software; you can redistribute it and/or modify it * This code is free software; you can redistribute it and/or modify it
@ -201,7 +201,7 @@ public interface ObjectStreamConstants {
new SerializablePermission("enableSubclassImplementation"); new SerializablePermission("enableSubclassImplementation");
/** /**
* Enable setting the process-wide serial filter. * Enable setting the system-wide serial filter.
* *
* @see java.io.ObjectInputFilter.Config#setSerialFilter(ObjectInputFilter) * @see java.io.ObjectInputFilter.Config#setSerialFilter(ObjectInputFilter)
* @since 9 * @since 9

2
src/java.base/share/conf/security/java.security
View File

@ -920,7 +920,7 @@ jdk.xml.dsig.secureValidationPolicy=\
noRetrievalMethodLoops noRetrievalMethodLoops
# #
# Serialization process-wide filter # Serialization system-wide filter
# #
# A filter, if configured, is used by java.io.ObjectInputStream during # A filter, if configured, is used by java.io.ObjectInputStream during
# deserialization to check the contents of the stream. # deserialization to check the contents of the stream.