java.io.InvalidClassException Java Examples

private void skipCustomUsingFVD(ValueMember[] fields,
                                com.sun.org.omg.SendingContext.CodeBase sender)
                                throws InvalidClassException, StreamCorruptedException,
                                       ClassNotFoundException, IOException
{
    readFormatVersion();
    boolean calledDefaultWriteObject = readBoolean();

    if (calledDefaultWriteObject)
        throwAwayData(fields, sender);

    if (getStreamFormatVersion() == 2) {

        ((ValueInputStream)getOrbStream()).start_value();
        ((ValueInputStream)getOrbStream()).end_value();
    }
}
 

/**
 * Test SharedSecrets checkArray with unmodified ObjectInputStream.
 */
@Test(dataProvider = "Patterns")
public void normalOIS(String pattern, int arraySize, Object[] array) throws IOException {
    ObjectInputFilter filter = ObjectInputFilter.Config.createFilter(pattern);
    byte[] bytes = SerialFilterTest.writeObjects(array);
    try (ByteArrayInputStream bais = new ByteArrayInputStream(bytes);
         ObjectInputStream ois = new ObjectInputStream(bais)) {
        // Check the arraysize against the filter
        try {
            ObjectInputFilter.Config.setObjectInputFilter(ois, filter);
            SharedSecrets.getJavaOISAccess()
                    .checkArray(ois, array.getClass(), arraySize);
            Assert.assertTrue(array.length >= arraySize,
                    "Should have thrown InvalidClassException due to array size");
        } catch (InvalidClassException ice) {
            Assert.assertFalse(array.length > arraySize,
                    "Should NOT have thrown InvalidClassException due to array size");
        }
    }
}
 

private void skipCustomUsingFVD(ValueMember[] fields,
                                com.sun.org.omg.SendingContext.CodeBase sender)
                                throws InvalidClassException, StreamCorruptedException,
                                       ClassNotFoundException, IOException
{
    readFormatVersion();
    boolean calledDefaultWriteObject = readBoolean();

    if (calledDefaultWriteObject)
        throwAwayData(fields, sender);

    if (getStreamFormatVersion() == 2) {

        ((ValueInputStream)getOrbStream()).start_value();
        ((ValueInputStream)getOrbStream()).end_value();
    }
}
 

public static void testReadWrite() {
    try {
        ByteArrayOutputStream baos = new ByteArrayOutputStream();
        ObjectOutputStream oos = new ObjectOutputStream(baos);
        testWrite(oos);
        oos.flush();
        oos.close();
        byte buf[] = baos.toByteArray();
        ByteArrayInputStream bais = new ByteArrayInputStream(buf);
        ObjectInputStream ois = new ObjectInputStream(bais);
        testRead(ois, true);
    } catch (InvalidClassException ice) {
        throw new RuntimeException("Object read failed from loopback");
    } catch (IOException e) {
        e.printStackTrace();
        throw new RuntimeException("IOException testing loopback");
    }
}
 

/**
 * Test SharedSecrets checkArray with unmodified ObjectInputStream.
 */
@Test(dataProvider = "Patterns")
public void normalOIS(String pattern, int arraySize, Object[] array) throws IOException {
    ObjectInputFilter filter = ObjectInputFilter.Config.createFilter(pattern);
    byte[] bytes = SerialFilterTest.writeObjects(array);
    try (ByteArrayInputStream bais = new ByteArrayInputStream(bytes);
         ObjectInputStream ois = new ObjectInputStream(bais)) {
        // Check the arraysize against the filter
        try {
            ObjectInputFilter.Config.setObjectInputFilter(ois, filter);
            SharedSecrets.getJavaOISAccess()
                    .checkArray(ois, array.getClass(), arraySize);
            Assert.assertTrue(array.length >= arraySize,
                    "Should have thrown InvalidClassException due to array size");
        } catch (InvalidClassException ice) {
            Assert.assertFalse(array.length > arraySize,
                    "Should NOT have thrown InvalidClassException due to array size");
        }
    }
}
 

@Test(expected = InvalidClassException.class)
public void testThreadIssue() throws Exception {
    ByteArrayOutputStream bytes = new ByteArrayOutputStream();

    try (ObjectOutputStream stream = new ObjectOutputStream(bytes)) {
        stream.writeObject(42);
    }

    try (ObjectInputStream stream = new SerialKiller(new ByteArrayInputStream(bytes.toByteArray()), "src/test/resources/blacklist-all.conf")) {
        // Create a dummy SK with different config
        new SerialKiller(new ByteArrayInputStream(bytes.toByteArray()), "src/test/resources/whitelist-all.conf");

        stream.readObject();
        fail("All should be blacklisted");
    }
}
 

private static void writeInternal(byte type, Object object, DataOutput out) throws IOException {
    out.writeByte(type);
    switch (type) {
        case ZRULES:
            ((ZoneRules) object).writeExternal(out);
            break;
        case ZOT:
            ((ZoneOffsetTransition) object).writeExternal(out);
            break;
        case ZOTRULE:
            ((ZoneOffsetTransitionRule) object).writeExternal(out);
            break;
        default:
            throw new InvalidClassException("Unknown serialized type");
    }
}
 

/**
 * Test SharedSecrets checkArray with an ObjectInputStream subclassed to
 * handle all input stream functions.
 */
@Test(dataProvider = "Patterns")
public void subclassedOIS(String pattern, int arraySize, Object[] array) throws IOException {
    byte[] bytes = SerialFilterTest.writeObjects(array);
    try (ByteArrayInputStream bais = new ByteArrayInputStream(bytes);
         ObjectInputStream ois = new MyInputStream(bais)) {
        // Check the arraysize against the filter
        ObjectInputFilter filter = ObjectInputFilter.Config.createFilter(pattern);
        ObjectInputFilter.Config.setObjectInputFilter(ois, filter);
        SharedSecrets.getJavaOISAccess()
                .checkArray(ois, array.getClass(), arraySize);
        Assert.assertTrue(array.length >= arraySize,
                "Should have thrown InvalidClassException due to array size");
    } catch (InvalidClassException ice) {
        Assert.assertFalse(array.length > arraySize,
                "Should NOT have thrown InvalidClassException due to array size");
    }
}
 

private static void writeInternal(byte type, Object object, DataOutput out) throws IOException {
    out.writeByte(type);
    switch (type) {
        case ZRULES:
            ((ZoneRules) object).writeExternal(out);
            break;
        case ZOT:
            ((ZoneOffsetTransition) object).writeExternal(out);
            break;
        case ZOTRULE:
            ((ZoneOffsetTransitionRule) object).writeExternal(out);
            break;
        case TZRULES:
            ((ZoneRules) object).writeExternalTimeZone(out);
            break;
        default:
            throw new InvalidClassException("Unknown serialized type");
    }
}
 

private void skipCustomUsingFVD(ValueMember[] fields,
                                com.sun.org.omg.SendingContext.CodeBase sender)
                                throws InvalidClassException, StreamCorruptedException,
                                       ClassNotFoundException, IOException
{
    readFormatVersion();
    boolean calledDefaultWriteObject = readBoolean();

    if (calledDefaultWriteObject)
        throwAwayData(fields, sender);

    if (getStreamFormatVersion() == 2) {

        ((ValueInputStream)getOrbStream()).start_value();
        ((ValueInputStream)getOrbStream()).end_value();
    }
}
 

private void skipCustomUsingFVD(ValueMember[] fields,
                                com.sun.org.omg.SendingContext.CodeBase sender)
                                throws InvalidClassException, StreamCorruptedException,
                                       ClassNotFoundException, IOException
{
    readFormatVersion();
    boolean calledDefaultWriteObject = readBoolean();

    if (calledDefaultWriteObject)
        throwAwayData(fields, sender);

    if (getStreamFormatVersion() == 2) {

        ((ValueInputStream)getOrbStream()).start_value();
        ((ValueInputStream)getOrbStream()).end_value();
    }
}
 

/**
     * Serialize and deserialize an object using the default process-wide filter
     * and check allowed or reject.
     *
     * @param pattern the pattern
     * @param object the test object
     * @param allowed the expected result from ObjectInputStream (exception or not)
     */
    static void testGlobalPattern(String pattern, Object object, boolean allowed) {
        try {
//            System.out.printf("global %s pattern: %s, obj: %s%n", (allowed ? "allowed" : "not allowed"), pattern, object);
            byte[] bytes = SerialFilterTest.writeObjects(object);
            try (ByteArrayInputStream bais = new ByteArrayInputStream(bytes);
                 ObjectInputStream ois = new ObjectInputStream(bais)) {
                Object o = ois.readObject();
            } catch (EOFException eof) {
                // normal completion
            } catch (ClassNotFoundException cnf) {
                Assert.fail("Deserializing", cnf);
            }
            Assert.assertTrue(allowed, "filter should have thrown an exception");
        } catch (IllegalArgumentException iae) {
            Assert.fail("bad format pattern", iae);
        } catch (InvalidClassException ice) {
            Assert.assertFalse(allowed, "filter should not have thrown an exception: " + ice);
        } catch (IOException ioe) {
            Assert.fail("Unexpected IOException", ioe);
        }
    }
 

@SuppressWarnings("unchecked")
@Override
public void readExternal(final ObjectInput in) throws IOException, ClassNotFoundException {
	//super.readExternal(in);
	parent = Factory.getWrapperFactory();
	int version = in.readInt();
	if (version != EXTERNALVERSIONUID) {
		throw new InvalidClassException("Cannot read dataversion " + version);
	}

	sessionType_ = (SessionType) in.readObject();
	username_ = (String) in.readObject();
	currentDatabaseApiPath_ = (String) in.readObject();

	isAutoMime_ = (AutoMime) in.readObject();
	fixes_ = (Set<Fixes>) in.readObject();
	eventFactory_ = (IDominoEventFactory) in.readObject();
	featureRestricted_ = in.readBoolean();

}
 

public void runMain(String[] args) throws Exception {

        int pos = getMatchingPosition(args, "-dt", "--dataType");
        if (pos == -1) {
            log.error("no valid options");
            log.error("-dt, --dataType   Options: [CSV, IMAGE]");
            throw new Exception("no valid options");
        } else {
            transformDataType = TransformDataType.valueOf(args[pos + 1]);
        }

        switch (transformDataType) {
            case CSV:
                sparkTransformServer = new CSVSparkTransformServer();
                break;
            case IMAGE:
                sparkTransformServer = new ImageSparkTransformServer();
                break;
            default:
                throw new InvalidClassException("no matching SparkTransform class");
        }

        sparkTransformServer.runMain(args);
    }
 

/*******************
 * Check if the given endpoint can be attacked.
 * 
 * This check is performed by executing a dummy attack against the
 * endpoint and observing the resulting exception.
 * 
 * @param ep An enumerated RMI endpoint.
 * @return True if we can attack it.
 ******************/
public boolean canAttackEndpoint(RMIEndpoint ep) {
	RMIBindExploitProxy proxy = null;
	Registry reg;
	
	//Execute a dummy attack
	try {
		//Start a bind exploit proxy
		proxy = new RMIBindExploitProxy(InetAddress.getByName(ep.getEndpoint().getHost()), ep.getEndpoint().getPort(), this._options, this._dummyPayload);
		proxy.startProxy();
		
		//Get a proxied RMI registry reference
		reg = LocateRegistry.getRegistry(proxy.getServerListenAddress().getHostAddress(), proxy.getServerListenPort());
		
		//Bind a dummy object in an attempt to trigger the vulnerability
		reg.bind(this.generateRandomString(), new BaRMIeBindExploit());
	} catch(BaRMIeException | UnknownHostException | RemoteException | AlreadyBoundException ex) {
		//An up to date RMI registry will, by default, reject the dummy object
		if(ex instanceof ServerException && ex.getCause() != null && ex.getCause() instanceof UnmarshalException && ex.getCause().getCause() != null && ex.getCause().getCause() instanceof InvalidClassException) {
			//Check for "filter status: REJECTED"
			if(ex.getCause().getCause().toString().contains("filter status: REJECTED")) {
				//Test payload was filtered, likely this attack isn't possible
				return false;
			}
		}
	} finally {
		//Stop the proxy
		if(proxy != null) {
			proxy.stopProxy(true);
		}
	}
	
	//In all other cases we should be able to attack the registry
	return true;
}
 

void readFields(java.util.Map fieldToValueMap)
    throws InvalidClassException, StreamCorruptedException,
           ClassNotFoundException, IOException {

    if (mustUseRemoteValueMembers()) {
        inputRemoteMembersForReadFields(fieldToValueMap);
    } else
        inputCurrentClassFieldsForReadFields(fieldToValueMap);
}
 

private static void writeInternal(byte type, Object object, ObjectOutput out) throws IOException {
    out.writeByte(type);
    switch (type) {
        case CHRONO_TYPE:
            ((AbstractChronology) object).writeExternal(out);
            break;
        case CHRONO_LOCAL_DATE_TIME_TYPE:
            ((ChronoLocalDateTimeImpl<?>) object).writeExternal(out);
            break;
        case CHRONO_ZONE_DATE_TIME_TYPE:
            ((ChronoZonedDateTimeImpl<?>) object).writeExternal(out);
            break;
        case JAPANESE_DATE_TYPE:
            ((JapaneseDate) object).writeExternal(out);
            break;
        case JAPANESE_ERA_TYPE:
            ((JapaneseEra) object).writeExternal(out);
            break;
        case HIJRAH_DATE_TYPE:
            ((HijrahDate) object).writeExternal(out);
            break;
        case MINGUO_DATE_TYPE:
            ((MinguoDate) object).writeExternal(out);
            break;
        case THAIBUDDHIST_DATE_TYPE:
            ((ThaiBuddhistDate) object).writeExternal(out);
            break;
        case CHRONO_PERIOD_TYPE:
            ((ChronoPeriodImpl) object).writeExternal(out);
            break;
        default:
            throw new InvalidClassException("Unknown serialized type");
    }
}
 

public GraphSimilarity getSimilarityBetween(Object oFirst, Object oSecond) throws InvalidClassException {
    if (!((oFirst instanceof NGramDocument) && (oSecond instanceof NGramDocument)))
        throw new InvalidClassException("Both operands should be Documents (" + NGramDocument.class.getName() + 
                " class)");
    NGramDocument dFirst = (NGramDocument)oFirst;
    NGramDocument dSecond = (NGramDocument)oSecond;
    NGramCachedGraphComparator gcComparator = new NGramCachedGraphComparator();
    NGramHistogramComparator hcComparator = new NGramHistogramComparator();
    
    GraphSimilarity[] saSimil = new GraphSimilarity[2];
    //gcComparator.setNotificationListener(this); // Set this to listener
    // Graph GraphSimilarity
    saSimil[0] = gcComparator.getSimilarityBetween(dFirst.getDocumentGraph(), dSecond.getDocumentGraph());
    sGraph = saSimil[0];
    // Histogram GraphSimilarity
    saSimil[1] = hcComparator.getSimilarityBetween(dFirst.getDocumentHistogram(), dSecond.getDocumentHistogram());
    sHistogram = saSimil[1];
    
    GraphSimilarity sSimil = new GraphSimilarity();
    sSimil.ContainmentSimilarity = saSimil[0].ContainmentSimilarity * GraphImportance +
            saSimil[1].ContainmentSimilarity * (1 - GraphImportance);
    sSimil.ValueSimilarity = saSimil[0].ValueSimilarity * GraphImportance +
            saSimil[1].ValueSimilarity * (1 - GraphImportance);
    sSimil.SizeSimilarity = saSimil[0].SizeSimilarity * GraphImportance +
            saSimil[1].SizeSimilarity * (1 - GraphImportance);
            
    return sSimil;
}
 

/**
 * Reads the "cause" field from the stream.
 * And initializes the "cause" if it wasn't
 * done before.
 *
 * @param in stream used for deserialization
 * @throws IOException thrown by <code>ObjectInputStream</code>
 * @throws ClassNotFoundException  thrown by <code>ObjectInputStream</code>
 */
private void readObject(ObjectInputStream in)
        throws IOException, ClassNotFoundException
{
    ObjectInputStream.GetField fields = in.readFields();
    Throwable scause = (Throwable) fields.get("cause", null);

    if (super.getCause() == null && scause != null) {
        try {
            super.initCause(scause);
        } catch(IllegalStateException e) {
            throw new InvalidClassException("Inconsistent state: two causes");
        }
    }
}
 

private static void writeInternal(byte type, Object object, ObjectOutput out) throws IOException {
    out.writeByte(type);
    switch (type) {
        case CHRONO_TYPE:
            ((AbstractChronology) object).writeExternal(out);
            break;
        case CHRONO_LOCAL_DATE_TIME_TYPE:
            ((ChronoLocalDateTimeImpl<?>) object).writeExternal(out);
            break;
        case CHRONO_ZONE_DATE_TIME_TYPE:
            ((ChronoZonedDateTimeImpl<?>) object).writeExternal(out);
            break;
        case JAPANESE_DATE_TYPE:
            ((JapaneseDate) object).writeExternal(out);
            break;
        case JAPANESE_ERA_TYPE:
            ((JapaneseEra) object).writeExternal(out);
            break;
        case HIJRAH_DATE_TYPE:
            ((HijrahDate) object).writeExternal(out);
            break;
        case MINGUO_DATE_TYPE:
            ((MinguoDate) object).writeExternal(out);
            break;
        case THAIBUDDHIST_DATE_TYPE:
            ((ThaiBuddhistDate) object).writeExternal(out);
            break;
        case CHRONO_PERIOD_TYPE:
            ((ChronoPeriodImpl) object).writeExternal(out);
            break;
        default:
            throw new InvalidClassException("Unknown serialized type");
    }
}
 

/**
 * Test that returning null from a filter causes deserialization to fail.
 */
@Test(expectedExceptions=InvalidClassException.class)
static void testNullStatus() throws IOException {
    byte[] bytes = writeObjects(0); // an Integer
    try {
        Object o = validate(bytes, new ObjectInputFilter() {
            public ObjectInputFilter.Status checkInput(ObjectInputFilter.FilterInfo f) {
                return null;
            }
        });
    } catch (InvalidClassException ice) {
        System.out.printf("Success exception: %s%n", ice);
        throw ice;
    }
}
 

/** Initializes the comparator object to a default comparator, if null. */
protected void initComparator() {
    final ProgressEvent peCreation = new ProgressEvent("Comparison", 0.0);
    
    final NGramCachedGraphComparator gcComparator = 
            new NGramCachedGraphComparator();
    
    if (Comparator == null)
        Comparator = new SimilarityComparatorListener() {
            public ProgressEvent event = peCreation;
            
        @Override
            public synchronized ISimilarity getSimilarityBetween(Object oFirst, 
                    Object oSecond) throws InvalidClassException {
                NamedDocumentNGramGraph pCurDocArg = 
                        (NamedDocumentNGramGraph)oFirst;
                NamedDocumentNGramGraph pCompareToDocArg = 
                        (NamedDocumentNGramGraph)oSecond;
                GraphSimilarity sSimil = null;

                peCreation.updateSubtask("Comparing documents");
                sSimil = gcComparator.getSimilarityBetween(pCurDocArg,
                        pCompareToDocArg);
                if (Notifier != null)
                    Notifier.Notify(this, 
                            peCreation.updateProgress(peCreation.Progress + 1.0));
                /*sSimil.setCalculator(new CalculatorListener<GraphSimilarity, GraphSimilarity>() {
                    public double Calculate(GraphSimilarity oCaller, GraphSimilarity oCalculationParams) {
                        // Return size normalized value similarity
                        return oCalculationParams.ValueSimilarity / oCalculationParams.SizeSimilarity;
                    }
                });*/
                return sSimil;
            }
        };
}
 

public GraphSimilarity getSimilarityBetween(Object oFirst, Object oSecond) throws InvalidClassException {
    if (!((oFirst instanceof NGramDocument) && (oSecond instanceof NGramDocument)))
        throw new InvalidClassException("Both operands should be Documents (" + NGramDocument.class.getName() + 
                " class)");
    NGramDocument dFirst = (NGramDocument)oFirst;
    NGramDocument dSecond = (NGramDocument)oSecond;
    NGramCachedGraphComparator gcComparator = new NGramCachedGraphComparator();
    NGramHistogramComparator hcComparator = new NGramHistogramComparator();
    
    GraphSimilarity[] saSimil = new GraphSimilarity[2];
    //gcComparator.setNotificationListener(this); // Set this to listener
    // Graph GraphSimilarity
    saSimil[0] = gcComparator.getSimilarityBetween(dFirst.getDocumentGraph(), dSecond.getDocumentGraph());
    sGraph = saSimil[0];
    // Histogram GraphSimilarity
    saSimil[1] = hcComparator.getSimilarityBetween(dFirst.getDocumentHistogram(), dSecond.getDocumentHistogram());
    sHistogram = saSimil[1];
    
    GraphSimilarity sSimil = new GraphSimilarity();
    sSimil.ContainmentSimilarity = saSimil[0].ContainmentSimilarity * GraphImportance +
            saSimil[1].ContainmentSimilarity * (1 - GraphImportance);
    sSimil.ValueSimilarity = saSimil[0].ValueSimilarity * GraphImportance +
            saSimil[1].ValueSimilarity * (1 - GraphImportance);
    sSimil.SizeSimilarity = saSimil[0].SizeSimilarity * GraphImportance +
            saSimil[1].SizeSimilarity * (1 - GraphImportance);
            
    return sSimil;
}
 

private static void writeInternal(byte type, Object object, ObjectOutput out) throws IOException {
    out.writeByte(type);
    switch (type) {
        case CHRONO_TYPE:
            ((AbstractChronology) object).writeExternal(out);
            break;
        case CHRONO_LOCAL_DATE_TIME_TYPE:
            ((ChronoLocalDateTimeImpl<?>) object).writeExternal(out);
            break;
        case CHRONO_ZONE_DATE_TIME_TYPE:
            ((ChronoZonedDateTimeImpl<?>) object).writeExternal(out);
            break;
        case JAPANESE_DATE_TYPE:
            ((JapaneseDate) object).writeExternal(out);
            break;
        case JAPANESE_ERA_TYPE:
            ((JapaneseEra) object).writeExternal(out);
            break;
        case HIJRAH_DATE_TYPE:
            ((HijrahDate) object).writeExternal(out);
            break;
        case MINGUO_DATE_TYPE:
            ((MinguoDate) object).writeExternal(out);
            break;
        case THAIBUDDHIST_DATE_TYPE:
            ((ThaiBuddhistDate) object).writeExternal(out);
            break;
        case CHRONO_PERIOD_TYPE:
            ((ChronoPeriodImpl) object).writeExternal(out);
            break;
        default:
            throw new InvalidClassException("Unknown serialized type");
    }
}
 

/**
 * Create a filter from a pattern and API factory, then serialize and
 * deserialize an object and check allowed or reject.
 *
 * @param pattern the pattern
 * @param object the test object
 * @param allowed the expected result from ObjectInputStream (exception or not)
 */
static void testPatterns(String pattern, Object object, boolean allowed) {
    try {
        byte[] bytes = SerialFilterTest.writeObjects(object);
        ObjectInputFilter filter = ObjectInputFilter.Config.createFilter(pattern);
        validate(bytes, filter);
        Assert.assertTrue(allowed, "filter should have thrown an exception");
    } catch (IllegalArgumentException iae) {
        Assert.fail("bad format pattern", iae);
    } catch (InvalidClassException ice) {
        Assert.assertFalse(allowed, "filter should not have thrown an exception: " + ice);
    } catch (IOException ioe) {
        Assert.fail("Unexpected IOException", ioe);
    }
}
 

private static void writeInternal(byte type, Object object, ObjectOutput out) throws IOException {
    out.writeByte(type);
    switch (type) {
        case CHRONO_TYPE:
            ((AbstractChronology) object).writeExternal(out);
            break;
        case CHRONO_LOCAL_DATE_TIME_TYPE:
            ((ChronoLocalDateTimeImpl<?>) object).writeExternal(out);
            break;
        case CHRONO_ZONE_DATE_TIME_TYPE:
            ((ChronoZonedDateTimeImpl<?>) object).writeExternal(out);
            break;
        case JAPANESE_DATE_TYPE:
            ((JapaneseDate) object).writeExternal(out);
            break;
        case JAPANESE_ERA_TYPE:
            ((JapaneseEra) object).writeExternal(out);
            break;
        case HIJRAH_DATE_TYPE:
            ((HijrahDate) object).writeExternal(out);
            break;
        case MINGUO_DATE_TYPE:
            ((MinguoDate) object).writeExternal(out);
            break;
        case THAIBUDDHIST_DATE_TYPE:
            ((ThaiBuddhistDate) object).writeExternal(out);
            break;
        case CHRONO_PERIOD_TYPE:
            ((ChronoPeriodImpl) object).writeExternal(out);
            break;
        default:
            throw new InvalidClassException("Unknown serialized type");
    }
}
 

public static void readSer(String filename, boolean shouldsucceed) {
    try {
        FileInputStream fis = new FileInputStream(resolve(filename));
        ObjectInputStream ois = new ObjectInputStream(fis);
        testRead(ois, shouldsucceed);
    } catch (InvalidClassException ice) {
        throw new RuntimeException("Object read failed from: "+filename);
    } catch (IOException e) {
        e.printStackTrace();
        throw new RuntimeException("IOException reading: "+filename);
    }
}
 

/**
 * Test that returning null from a filter causes deserialization to fail.
 */
@Test(expectedExceptions=InvalidClassException.class)
static void testNullStatus() throws IOException {
    byte[] bytes = writeObjects(0); // an Integer
    try {
        Object o = validate(bytes, new ObjectInputFilter() {
            public ObjectInputFilter.Status checkInput(ObjectInputFilter.FilterInfo f) {
                return null;
            }
        });
    } catch (InvalidClassException ice) {
        System.out.printf("Success exception: %s%n", ice);
        throw ice;
    }
}
 

private static Object deserialize(byte[] objectData, ClassLoader classLoader) throws InvalidClassException {
    if (objectData == null) {
        throw new IllegalArgumentException("The byte[] must not be null");
    }
    ByteArrayInputStream bais = new ByteArrayInputStream(objectData);
    return deserialize(bais, classLoader);
}
 

public static XdrString decode(XdrDataInputStream stream, int maxSize) throws IOException {
    int size = stream.readInt();
    if (size > maxSize) {
        throw new InvalidClassException("String length "+size+" exceeds max size "+maxSize);
    }
    byte[] bytes = new byte[size];
    stream.read(bytes);
    return new XdrString(bytes);
}