Java Code Examples for sun.misc.ObjectInputFilter#FilterInfo

The following examples show how to use sun.misc.ObjectInputFilter#FilterInfo . You can vote up the ones you like or vote down the ones you don't like, and go to the original project or source file by following the links above each example. You may check out the related API usage on the sidebar.
Example 1
Source File: JceKeyStore.java    From openjdk-jdk8u with GNU General Public License v2.0 6 votes vote down vote up 
@Override
public ObjectInputFilter.Status
    checkInput(ObjectInputFilter.FilterInfo info) {

    // First run a custom filter
    long nestedDepth = info.depth();
    if ((nestedDepth == 1 &&
                info.serialClass() != SealedObjectForKeyProtector.class) ||
            info.arrayLength() > fullLength ||
            (nestedDepth > MAX_NESTED_DEPTH &&
                info.serialClass() != null &&
                info.serialClass() != Object.class)) {
        return Status.REJECTED;
    }

    // Next run the default filter, if available
    ObjectInputFilter defaultFilter =
        ObjectInputFilter.Config.getSerialFilter();
    if (defaultFilter != null) {
        return defaultFilter.checkInput(info);
    }

    return Status.UNDECIDED;
}
Example 2
Source File: JceKeyStore.java    From openjdk-jdk8u-backup with GNU General Public License v2.0 6 votes vote down vote up 
@Override
public ObjectInputFilter.Status
    checkInput(ObjectInputFilter.FilterInfo info) {

    // First run a custom filter
    long nestedDepth = info.depth();
    if ((nestedDepth == 1 &&
        info.serialClass() != SealedObjectForKeyProtector.class) ||
        nestedDepth > MAX_NESTED_DEPTH) {
        return Status.REJECTED;
    }

    // Next run the default filter, if available
    ObjectInputFilter defaultFilter =
        ObjectInputFilter.Config.getSerialFilter();
    if (defaultFilter != null) {
        return defaultFilter.checkInput(info);
    }

    return Status.UNDECIDED;
}
Example 3
Source File: JceKeyStore.java    From dragonwell8_jdk with GNU General Public License v2.0 6 votes vote down vote up 
@Override
public ObjectInputFilter.Status
    checkInput(ObjectInputFilter.FilterInfo info) {

    // First run a custom filter
    long nestedDepth = info.depth();
    if ((nestedDepth == 1 &&
                info.serialClass() != SealedObjectForKeyProtector.class) ||
            (nestedDepth > MAX_NESTED_DEPTH &&
                info.serialClass() != null &&
                info.serialClass() != Object.class)) {
        return Status.REJECTED;
    }

    // Next run the default filter, if available
    ObjectInputFilter defaultFilter =
        ObjectInputFilter.Config.getSerialFilter();
    if (defaultFilter != null) {
        return defaultFilter.checkInput(info);
    }

    return Status.UNDECIDED;
}
Example 4
Source File: JceKeyStore.java    From TencentKona-8 with GNU General Public License v2.0 6 votes vote down vote up 
@Override
public ObjectInputFilter.Status
    checkInput(ObjectInputFilter.FilterInfo info) {

    // First run a custom filter
    long nestedDepth = info.depth();
    if ((nestedDepth == 1 &&
                info.serialClass() != SealedObjectForKeyProtector.class) ||
            (nestedDepth > MAX_NESTED_DEPTH &&
                info.serialClass() != null &&
                info.serialClass() != Object.class)) {
        return Status.REJECTED;
    }

    // Next run the default filter, if available
    ObjectInputFilter defaultFilter =
        ObjectInputFilter.Config.getSerialFilter();
    if (defaultFilter != null) {
        return defaultFilter.checkInput(info);
    }

    return Status.UNDECIDED;
}
Example 5
Source File: SealedObjectForKeyProtector.java    From TencentKona-8 with GNU General Public License v2.0 6 votes vote down vote up 
@Override
public ObjectInputFilter.Status checkInput(
        ObjectInputFilter.FilterInfo info) {

    if (info.serialClass() == Object.class) {
        return Status.UNDECIDED;
    }

    if (base != null) {
        Status result = base.checkInput(info);
        if (result != Status.UNDECIDED) {
            return result;
        }
    }

    ObjectInputFilter defaultFilter =
            ObjectInputFilter.Config.getSerialFilter();
    if (defaultFilter != null) {
        return defaultFilter.checkInput(info);
    }

    return Status.UNDECIDED;
}
Example 6
Source File: SingleEntryRegistry.java    From TencentKona-8 with GNU General Public License v2.0 5 votes vote down vote up 
/**
 * ObjectInputFilter to check parameters to SingleEntryRegistry.
 * Since it is a read-only Registry, no classes are accepted.
 * String arguments are accepted without passing them to the serialFilter.
 *
 * @param info a reference to the serialization filter information
 * @return Status.REJECTED if parameters are out of range
 */
private static ObjectInputFilter.Status singleRegistryFilter(ObjectInputFilter.FilterInfo info) {
    return (info.serialClass() != null ||
            info.depth() > 2 ||
            info.references() > 4 ||
            info.arrayLength() >= 0)
    ? ObjectInputFilter.Status.REJECTED
    : ObjectInputFilter.Status.ALLOWED;
}
Example 7
Source File: DGCImpl.java    From openjdk-jdk8u-backup with GNU General Public License v2.0 5 votes vote down vote up 
/**
 * ObjectInputFilter to filter DGC input objects.
 * The list of acceptable classes is very short and explicit.
 * The depth and array sizes are limited.
 *
 * @param filterInfo access to class, arrayLength, etc.
 * @return  {@link ObjectInputFilter.Status#ALLOWED} if allowed,
 *          {@link ObjectInputFilter.Status#REJECTED} if rejected,
 *          otherwise {@link ObjectInputFilter.Status#UNDECIDED}
 */
private static ObjectInputFilter.Status checkInput(ObjectInputFilter.FilterInfo filterInfo) {
    if (dgcFilter != null) {
        ObjectInputFilter.Status status = dgcFilter.checkInput(filterInfo);
        if (status != ObjectInputFilter.Status.UNDECIDED) {
            // The DGC filter can override the built-in white-list
            return status;
        }
    }

    if (filterInfo.depth() > DGC_MAX_DEPTH) {
        return ObjectInputFilter.Status.REJECTED;
    }
    Class<?> clazz = filterInfo.serialClass();
    if (clazz != null) {
        while (clazz.isArray()) {
            if (filterInfo.arrayLength() >= 0 && filterInfo.arrayLength() > DGC_MAX_ARRAY_SIZE) {
                return ObjectInputFilter.Status.REJECTED;
            }
            // Arrays are allowed depending on the component type
            clazz = clazz.getComponentType();
        }
        if (clazz.isPrimitive()) {
            // Arrays of primitives are allowed
            return ObjectInputFilter.Status.ALLOWED;
        }
        return (clazz == ObjID.class ||
                clazz == UID.class ||
                clazz == VMID.class ||
                clazz == Lease.class)
                ? ObjectInputFilter.Status.ALLOWED
                : ObjectInputFilter.Status.REJECTED;
    }
    // Not a class, not size limited
    return ObjectInputFilter.Status.UNDECIDED;
}
Example 8
Source File: SingleEntryRegistry.java    From openjdk-jdk8u-backup with GNU General Public License v2.0 5 votes vote down vote up 
/**
 * ObjectInputFilter to check parameters to SingleEntryRegistry.
 * Since it is a read-only Registry, no classes are accepted.
 * String arguments are accepted without passing them to the serialFilter.
 *
 * @param info a reference to the serialization filter information
 * @return Status.REJECTED if parameters are out of range
 */
private static ObjectInputFilter.Status singleRegistryFilter(ObjectInputFilter.FilterInfo info) {
    return (info.serialClass() != null ||
            info.depth() > 2 ||
            info.references() > 4 ||
            info.arrayLength() >= 0)
    ? ObjectInputFilter.Status.REJECTED
    : ObjectInputFilter.Status.ALLOWED;
}
Example 9
Source File: RegistryImpl.java    From openjdk-jdk8u with GNU General Public License v2.0 5 votes vote down vote up 
/**
 * ObjectInputFilter to filter Registry input objects.
 * The list of acceptable classes is limited to classes normally
 * stored in a registry.
 *
 * @param filterInfo access to the class, array length, etc.
 * @return  {@link ObjectInputFilter.Status#ALLOWED} if allowed,
 *          {@link ObjectInputFilter.Status#REJECTED} if rejected,
 *          otherwise {@link ObjectInputFilter.Status#UNDECIDED}
 */
private static ObjectInputFilter.Status registryFilter(ObjectInputFilter.FilterInfo filterInfo) {
    if (registryFilter != null) {
        ObjectInputFilter.Status status = registryFilter.checkInput(filterInfo);
        if (status != ObjectInputFilter.Status.UNDECIDED) {
            // The Registry filter can override the built-in white-list
            return status;
        }
    }

    if (filterInfo.depth() > REGISTRY_MAX_DEPTH) {
        return ObjectInputFilter.Status.REJECTED;
    }
    Class<?> clazz = filterInfo.serialClass();
    if (clazz != null) {
        if (clazz.isArray()) {
            // Arrays are REJECTED only if they exceed the limit
            return (filterInfo.arrayLength() >= 0 && filterInfo.arrayLength() > REGISTRY_MAX_ARRAY_SIZE)
                ? ObjectInputFilter.Status.REJECTED
                : ObjectInputFilter.Status.UNDECIDED;
        }
        if (String.class == clazz
                || java.lang.Number.class.isAssignableFrom(clazz)
                || Remote.class.isAssignableFrom(clazz)
                || java.lang.reflect.Proxy.class.isAssignableFrom(clazz)
                || UnicastRef.class.isAssignableFrom(clazz)
                || RMIClientSocketFactory.class.isAssignableFrom(clazz)
                || RMIServerSocketFactory.class.isAssignableFrom(clazz)
                || java.rmi.activation.ActivationID.class.isAssignableFrom(clazz)
                || java.rmi.server.UID.class.isAssignableFrom(clazz)) {
            return ObjectInputFilter.Status.ALLOWED;
        } else {
            return ObjectInputFilter.Status.REJECTED;
        }
    }
    return ObjectInputFilter.Status.UNDECIDED;
}
Example 10
Source File: FilterUSRTest.java    From openjdk-jdk8u with GNU General Public License v2.0 5 votes vote down vote up 
@Override
public Status checkInput(ObjectInputFilter.FilterInfo info) {
    if (info.serialClass() == RejectME.class) {
        return Status.REJECTED;
    }
    count++;
    return Status.UNDECIDED;
}
Example 11
Source File: DGCImpl_Stub.java    From openjdk-jdk8u with GNU General Public License v2.0 5 votes vote down vote up 
/**
 * ObjectInputFilter to filter DGCClient return value (a Lease).
 * The list of acceptable classes is very short and explicit.
 * The depth and array sizes are limited.
 * <p>
 * The filter must accept normal and exception returns.
 * A DGC server may throw exceptions that may have a cause
 * and suppressed exceptions.
 *
 * @param filterInfo access to class, arrayLength, etc.
 * @return  {@link ObjectInputFilter.Status#ALLOWED} if allowed,
 *          {@link ObjectInputFilter.Status#REJECTED} if rejected,
 *          otherwise {@link ObjectInputFilter.Status#UNDECIDED}
 */
private static ObjectInputFilter.Status leaseFilter(ObjectInputFilter.FilterInfo filterInfo) {

    if (filterInfo.depth() > DGCCLIENT_MAX_DEPTH) {
        return ObjectInputFilter.Status.REJECTED;
    }
    Class<?> clazz = filterInfo.serialClass();
    if (clazz != null) {
        while (clazz.isArray()) {
            if (filterInfo.arrayLength() >= 0 && filterInfo.arrayLength() > DGCCLIENT_MAX_ARRAY_SIZE) {
                return ObjectInputFilter.Status.REJECTED;
            }
            // Arrays are allowed depending on the component type
            clazz = clazz.getComponentType();
        }
        if (clazz.isPrimitive()) {
            // Arrays of primitives are allowed
            return ObjectInputFilter.Status.ALLOWED;
        }
        return (clazz == UID.class ||
                clazz == VMID.class ||
                clazz == Lease.class ||
                (Throwable.class.isAssignableFrom(clazz) &&
                        clazz.getClassLoader() ==
                        Object.class.getClassLoader()) ||
                clazz == StackTraceElement.class ||
                clazz == ArrayList.class ||     // for suppressed exceptions, if any
                clazz == Object.class ||
                clazz.getName().equals("java.util.Collections$UnmodifiableList") ||
                clazz.getName().equals("java.util.Collections$UnmodifiableCollection") ||
                clazz.getName().equals("java.util.Collections$UnmodifiableRandomAccessList"))
                ? ObjectInputFilter.Status.ALLOWED
                : ObjectInputFilter.Status.REJECTED;
    }
    // Not a class, not size limited
    return ObjectInputFilter.Status.UNDECIDED;
}
Example 12
Source File: FilterUSRTest.java    From TencentKona-8 with GNU General Public License v2.0 5 votes vote down vote up 
@Override
public Status checkInput(ObjectInputFilter.FilterInfo info) {
    if (info.serialClass() == RejectME.class) {
        return Status.REJECTED;
    }
    count++;
    return Status.UNDECIDED;
}
Example 13
Source File: RegistryImpl.java    From jdk8u_jdk with GNU General Public License v2.0 5 votes vote down vote up 
/**
 * ObjectInputFilter to filter Registry input objects.
 * The list of acceptable classes is limited to classes normally
 * stored in a registry.
 *
 * @param filterInfo access to the class, array length, etc.
 * @return  {@link ObjectInputFilter.Status#ALLOWED} if allowed,
 *          {@link ObjectInputFilter.Status#REJECTED} if rejected,
 *          otherwise {@link ObjectInputFilter.Status#UNDECIDED}
 */
private static ObjectInputFilter.Status registryFilter(ObjectInputFilter.FilterInfo filterInfo) {
    if (registryFilter != null) {
        ObjectInputFilter.Status status = registryFilter.checkInput(filterInfo);
        if (status != ObjectInputFilter.Status.UNDECIDED) {
            // The Registry filter can override the built-in white-list
            return status;
        }
    }

    if (filterInfo.depth() > REGISTRY_MAX_DEPTH) {
        return ObjectInputFilter.Status.REJECTED;
    }
    Class<?> clazz = filterInfo.serialClass();
    if (clazz != null) {
        if (clazz.isArray()) {
            // Arrays are REJECTED only if they exceed the limit
            return (filterInfo.arrayLength() >= 0 && filterInfo.arrayLength() > REGISTRY_MAX_ARRAY_SIZE)
                ? ObjectInputFilter.Status.REJECTED
                : ObjectInputFilter.Status.UNDECIDED;
        }
        if (String.class == clazz
                || java.lang.Number.class.isAssignableFrom(clazz)
                || Remote.class.isAssignableFrom(clazz)
                || java.lang.reflect.Proxy.class.isAssignableFrom(clazz)
                || UnicastRef.class.isAssignableFrom(clazz)
                || RMIClientSocketFactory.class.isAssignableFrom(clazz)
                || RMIServerSocketFactory.class.isAssignableFrom(clazz)
                || java.rmi.activation.ActivationID.class.isAssignableFrom(clazz)
                || java.rmi.server.UID.class.isAssignableFrom(clazz)) {
            return ObjectInputFilter.Status.ALLOWED;
        } else {
            return ObjectInputFilter.Status.REJECTED;
        }
    }
    return ObjectInputFilter.Status.UNDECIDED;
}
Example 14
Source File: RegistryImpl.java    From TencentKona-8 with GNU General Public License v2.0 5 votes vote down vote up 
/**
 * ObjectInputFilter to filter Registry input objects.
 * The list of acceptable classes is limited to classes normally
 * stored in a registry.
 *
 * @param filterInfo access to the class, array length, etc.
 * @return  {@link ObjectInputFilter.Status#ALLOWED} if allowed,
 *          {@link ObjectInputFilter.Status#REJECTED} if rejected,
 *          otherwise {@link ObjectInputFilter.Status#UNDECIDED}
 */
private static ObjectInputFilter.Status registryFilter(ObjectInputFilter.FilterInfo filterInfo) {
    if (registryFilter != null) {
        ObjectInputFilter.Status status = registryFilter.checkInput(filterInfo);
        if (status != ObjectInputFilter.Status.UNDECIDED) {
            // The Registry filter can override the built-in white-list
            return status;
        }
    }

    if (filterInfo.depth() > REGISTRY_MAX_DEPTH) {
        return ObjectInputFilter.Status.REJECTED;
    }
    Class<?> clazz = filterInfo.serialClass();
    if (clazz != null) {
        if (clazz.isArray()) {
            // Arrays are REJECTED only if they exceed the limit
            return (filterInfo.arrayLength() >= 0 && filterInfo.arrayLength() > REGISTRY_MAX_ARRAY_SIZE)
                ? ObjectInputFilter.Status.REJECTED
                : ObjectInputFilter.Status.UNDECIDED;
        }
        if (String.class == clazz
                || java.lang.Number.class.isAssignableFrom(clazz)
                || Remote.class.isAssignableFrom(clazz)
                || java.lang.reflect.Proxy.class.isAssignableFrom(clazz)
                || UnicastRef.class.isAssignableFrom(clazz)
                || RMIClientSocketFactory.class.isAssignableFrom(clazz)
                || RMIServerSocketFactory.class.isAssignableFrom(clazz)
                || java.rmi.activation.ActivationID.class.isAssignableFrom(clazz)
                || java.rmi.server.UID.class.isAssignableFrom(clazz)) {
            return ObjectInputFilter.Status.ALLOWED;
        } else {
            return ObjectInputFilter.Status.REJECTED;
        }
    }
    return ObjectInputFilter.Status.UNDECIDED;
}
Example 15
Source File: DGCImpl.java    From TencentKona-8 with GNU General Public License v2.0 5 votes vote down vote up 
/**
 * ObjectInputFilter to filter DGC input objects.
 * The list of acceptable classes is very short and explicit.
 * The depth and array sizes are limited.
 *
 * @param filterInfo access to class, arrayLength, etc.
 * @return  {@link ObjectInputFilter.Status#ALLOWED} if allowed,
 *          {@link ObjectInputFilter.Status#REJECTED} if rejected,
 *          otherwise {@link ObjectInputFilter.Status#UNDECIDED}
 */
private static ObjectInputFilter.Status checkInput(ObjectInputFilter.FilterInfo filterInfo) {
    if (dgcFilter != null) {
        ObjectInputFilter.Status status = dgcFilter.checkInput(filterInfo);
        if (status != ObjectInputFilter.Status.UNDECIDED) {
            // The DGC filter can override the built-in white-list
            return status;
        }
    }

    if (filterInfo.depth() > DGC_MAX_DEPTH) {
        return ObjectInputFilter.Status.REJECTED;
    }
    Class<?> clazz = filterInfo.serialClass();
    if (clazz != null) {
        while (clazz.isArray()) {
            if (filterInfo.arrayLength() >= 0 && filterInfo.arrayLength() > DGC_MAX_ARRAY_SIZE) {
                return ObjectInputFilter.Status.REJECTED;
            }
            // Arrays are allowed depending on the component type
            clazz = clazz.getComponentType();
        }
        if (clazz.isPrimitive()) {
            // Arrays of primitives are allowed
            return ObjectInputFilter.Status.ALLOWED;
        }
        return (clazz == ObjID.class ||
                clazz == UID.class ||
                clazz == VMID.class ||
                clazz == Lease.class)
                ? ObjectInputFilter.Status.ALLOWED
                : ObjectInputFilter.Status.REJECTED;
    }
    // Not a class, not size limited
    return ObjectInputFilter.Status.UNDECIDED;
}
Example 16
Source File: RegistryImpl.java    From openjdk-jdk8u-backup with GNU General Public License v2.0 5 votes vote down vote up 
/**
 * ObjectInputFilter to filter Registry input objects.
 * The list of acceptable classes is limited to classes normally
 * stored in a registry.
 *
 * @param filterInfo access to the class, array length, etc.
 * @return  {@link ObjectInputFilter.Status#ALLOWED} if allowed,
 *          {@link ObjectInputFilter.Status#REJECTED} if rejected,
 *          otherwise {@link ObjectInputFilter.Status#UNDECIDED}
 */
private static ObjectInputFilter.Status registryFilter(ObjectInputFilter.FilterInfo filterInfo) {
    if (registryFilter != null) {
        ObjectInputFilter.Status status = registryFilter.checkInput(filterInfo);
        if (status != ObjectInputFilter.Status.UNDECIDED) {
            // The Registry filter can override the built-in white-list
            return status;
        }
    }

    if (filterInfo.depth() > REGISTRY_MAX_DEPTH) {
        return ObjectInputFilter.Status.REJECTED;
    }
    Class<?> clazz = filterInfo.serialClass();
    if (clazz != null) {
        if (clazz.isArray()) {
            // Arrays are REJECTED only if they exceed the limit
            return (filterInfo.arrayLength() >= 0 && filterInfo.arrayLength() > REGISTRY_MAX_ARRAY_SIZE)
                ? ObjectInputFilter.Status.REJECTED
                : ObjectInputFilter.Status.UNDECIDED;
        }
        if (String.class == clazz
                || java.lang.Number.class.isAssignableFrom(clazz)
                || Remote.class.isAssignableFrom(clazz)
                || java.lang.reflect.Proxy.class.isAssignableFrom(clazz)
                || UnicastRef.class.isAssignableFrom(clazz)
                || RMIClientSocketFactory.class.isAssignableFrom(clazz)
                || RMIServerSocketFactory.class.isAssignableFrom(clazz)
                || java.rmi.activation.ActivationID.class.isAssignableFrom(clazz)
                || java.rmi.server.UID.class.isAssignableFrom(clazz)) {
            return ObjectInputFilter.Status.ALLOWED;
        } else {
            return ObjectInputFilter.Status.REJECTED;
        }
    }
    return ObjectInputFilter.Status.UNDECIDED;
}
Example 17
Source File: DGCImpl_Stub.java    From jdk8u_jdk with GNU General Public License v2.0 5 votes vote down vote up 
/**
 * ObjectInputFilter to filter DGCClient return value (a Lease).
 * The list of acceptable classes is very short and explicit.
 * The depth and array sizes are limited.
 * <p>
 * The filter must accept normal and exception returns.
 * A DGC server may throw exceptions that may have a cause
 * and suppressed exceptions.
 *
 * @param filterInfo access to class, arrayLength, etc.
 * @return  {@link ObjectInputFilter.Status#ALLOWED} if allowed,
 *          {@link ObjectInputFilter.Status#REJECTED} if rejected,
 *          otherwise {@link ObjectInputFilter.Status#UNDECIDED}
 */
private static ObjectInputFilter.Status leaseFilter(ObjectInputFilter.FilterInfo filterInfo) {

    if (filterInfo.depth() > DGCCLIENT_MAX_DEPTH) {
        return ObjectInputFilter.Status.REJECTED;
    }
    Class<?> clazz = filterInfo.serialClass();
    if (clazz != null) {
        while (clazz.isArray()) {
            if (filterInfo.arrayLength() >= 0 && filterInfo.arrayLength() > DGCCLIENT_MAX_ARRAY_SIZE) {
                return ObjectInputFilter.Status.REJECTED;
            }
            // Arrays are allowed depending on the component type
            clazz = clazz.getComponentType();
        }
        if (clazz.isPrimitive()) {
            // Arrays of primitives are allowed
            return ObjectInputFilter.Status.ALLOWED;
        }
        return (clazz == UID.class ||
                clazz == VMID.class ||
                clazz == Lease.class ||
                (Throwable.class.isAssignableFrom(clazz) &&
                        clazz.getClassLoader() ==
                        Object.class.getClassLoader()) ||
                clazz == StackTraceElement.class ||
                clazz == ArrayList.class ||     // for suppressed exceptions, if any
                clazz == Object.class ||
                clazz.getName().equals("java.util.Collections$UnmodifiableList") ||
                clazz.getName().equals("java.util.Collections$UnmodifiableCollection") ||
                clazz.getName().equals("java.util.Collections$UnmodifiableRandomAccessList"))
                ? ObjectInputFilter.Status.ALLOWED
                : ObjectInputFilter.Status.REJECTED;
    }
    // Not a class, not size limited
    return ObjectInputFilter.Status.UNDECIDED;
}
Example 18
Source File: FilterUSRTest.java    From jdk8u-jdk with GNU General Public License v2.0 5 votes vote down vote up 
@Override
public Status checkInput(ObjectInputFilter.FilterInfo info) {
    if (info.serialClass() == RejectME.class) {
        return Status.REJECTED;
    }
    count++;
    return Status.UNDECIDED;
}
Example 19
Source File: RegistryImpl.java    From dragonwell8_jdk with GNU General Public License v2.0 5 votes vote down vote up 
/**
 * ObjectInputFilter to filter Registry input objects.
 * The list of acceptable classes is limited to classes normally
 * stored in a registry.
 *
 * @param filterInfo access to the class, array length, etc.
 * @return  {@link ObjectInputFilter.Status#ALLOWED} if allowed,
 *          {@link ObjectInputFilter.Status#REJECTED} if rejected,
 *          otherwise {@link ObjectInputFilter.Status#UNDECIDED}
 */
private static ObjectInputFilter.Status registryFilter(ObjectInputFilter.FilterInfo filterInfo) {
    if (registryFilter != null) {
        ObjectInputFilter.Status status = registryFilter.checkInput(filterInfo);
        if (status != ObjectInputFilter.Status.UNDECIDED) {
            // The Registry filter can override the built-in white-list
            return status;
        }
    }

    if (filterInfo.depth() > REGISTRY_MAX_DEPTH) {
        return ObjectInputFilter.Status.REJECTED;
    }
    Class<?> clazz = filterInfo.serialClass();
    if (clazz != null) {
        if (clazz.isArray()) {
            // Arrays are REJECTED only if they exceed the limit
            return (filterInfo.arrayLength() >= 0 && filterInfo.arrayLength() > REGISTRY_MAX_ARRAY_SIZE)
                ? ObjectInputFilter.Status.REJECTED
                : ObjectInputFilter.Status.UNDECIDED;
        }
        if (String.class == clazz
                || java.lang.Number.class.isAssignableFrom(clazz)
                || Remote.class.isAssignableFrom(clazz)
                || java.lang.reflect.Proxy.class.isAssignableFrom(clazz)
                || UnicastRef.class.isAssignableFrom(clazz)
                || RMIClientSocketFactory.class.isAssignableFrom(clazz)
                || RMIServerSocketFactory.class.isAssignableFrom(clazz)
                || java.rmi.activation.ActivationID.class.isAssignableFrom(clazz)
                || java.rmi.server.UID.class.isAssignableFrom(clazz)) {
            return ObjectInputFilter.Status.ALLOWED;
        } else {
            return ObjectInputFilter.Status.REJECTED;
        }
    }
    return ObjectInputFilter.Status.UNDECIDED;
}
Example 20
Source File: DGCImpl.java    From dragonwell8_jdk with GNU General Public License v2.0 5 votes vote down vote up 
/**
 * ObjectInputFilter to filter DGC input objects.
 * The list of acceptable classes is very short and explicit.
 * The depth and array sizes are limited.
 *
 * @param filterInfo access to class, arrayLength, etc.
 * @return  {@link ObjectInputFilter.Status#ALLOWED} if allowed,
 *          {@link ObjectInputFilter.Status#REJECTED} if rejected,
 *          otherwise {@link ObjectInputFilter.Status#UNDECIDED}
 */
private static ObjectInputFilter.Status checkInput(ObjectInputFilter.FilterInfo filterInfo) {
    if (dgcFilter != null) {
        ObjectInputFilter.Status status = dgcFilter.checkInput(filterInfo);
        if (status != ObjectInputFilter.Status.UNDECIDED) {
            // The DGC filter can override the built-in white-list
            return status;
        }
    }

    if (filterInfo.depth() > DGC_MAX_DEPTH) {
        return ObjectInputFilter.Status.REJECTED;
    }
    Class<?> clazz = filterInfo.serialClass();
    if (clazz != null) {
        while (clazz.isArray()) {
            if (filterInfo.arrayLength() >= 0 && filterInfo.arrayLength() > DGC_MAX_ARRAY_SIZE) {
                return ObjectInputFilter.Status.REJECTED;
            }
            // Arrays are allowed depending on the component type
            clazz = clazz.getComponentType();
        }
        if (clazz.isPrimitive()) {
            // Arrays of primitives are allowed
            return ObjectInputFilter.Status.ALLOWED;
        }
        return (clazz == ObjID.class ||
                clazz == UID.class ||
                clazz == VMID.class ||
                clazz == Lease.class)
                ? ObjectInputFilter.Status.ALLOWED
                : ObjectInputFilter.Status.REJECTED;
    }
    // Not a class, not size limited
    return ObjectInputFilter.Status.UNDECIDED;
}