Java平台标准版核心库：JDK19开发者指南

需积分: 5 180 浏览量更新于2024-06-22 收藏 877KB PDF 举报

"JDK19-java-core-libraries-developer-guide.pdf" 本文档详细介绍了Java Platform, Standard Edition (Java SE) 19的核心库开发者指南。这个版本的JDK带来了新的特性和改进，旨在增强Java开发者的体验并提高应用程序的性能。作为Java核心库的一部分，这些库是Java SE平台的基础，提供了广泛的功能，包括基本数据类型、集合框架、I/O流、网络编程、多线程、异常处理以及许多其他关键服务。在JDK 19中，开发者可以期待以下主要知识点： 1. **模块系统更新**：Java模块系统自从Java 9引入以来一直在不断进化。JDK 19可能包含对模块系统的新优化，以改善模块间的依赖管理和打包流程。 2. **语言和API增强**：Java语言可能有新的语法特性或现有API的扩展，比如对`Record`类的进一步改进，或者引入新的并发工具类。 3. **集合框架改进**：Java的集合框架（如`List`, `Set`, `Map`）可能会有性能提升，新的接口或方法也可能被添加以提供更便捷的数据操作。 4. **安全增强**：JDK的安全组件可能会得到升级，以应对新的安全威胁，并提供更强大的加密算法和支持。 5. **垃圾收集器优化**：Java内存管理的关键部分，垃圾收集器，可能会有新的调整或优化，以提高应用程序的运行效率和内存利用率。 6. **JVM性能改进**：JDK 19可能会包含针对Java虚拟机（JVM）的性能提升，包括编译优化、内存管理和其他低层次的改进。 7. **文本块的完善**：自Java 13引入以来，文本块已经成为一种编写多行字符串的方便方式，JDK 19可能会对其语法或处理进行微调，以提高可读性和实用性。 8. **JEPs（Java Enhancement Proposals）**：每个JDK版本都包含多个JEP，这些提案详细描述了新功能或改进。JDK 19的JEPs将涵盖各种主题，从开发者工具到核心库的更新。 9. **工具和命令行界面**：开发工具如`jlink`和`jpackage`可能会有新功能或改进，以帮助构建和部署Java应用程序。命令行选项也可能有所调整，以增强用户体验。 10. **兼容性和稳定性**：JDK 19将继续致力于保持向后兼容性，确保已有的Java代码能够顺利运行。同时，稳定性将是重点，修复已知的bug和潜在问题。请记住，由于文档的版权限制，除非有特定的许可，否则不得非法复制、修改或分发。若发现任何错误，应书面报告给Oracle公司。对于美国政府用户，该软件及其文档可能受到特定的法规约束，包括但不限于联邦收购法规（FAR）和补充规定。

In the following example, the filter rejects one class name from a package (

example.somepackage.SomeClass

), and allows all other class names in the package:

jdk.serialFilter=!example.somepackage.SomeClass;example.somepackage.*;

The previous example filter allows all other class names, not just those in

example.somepackage.*

. To reject all other class names, add

jdk.serialFilter=!example.somepackage.SomeClass;example.somepackage.*;!

Define a Resource Limit Filter

A resource filter limits graph complexity and size. You can create filters for the

following parameters to control the resource usage for each application:

• Maximum allowed array size. For example:

maxarray=100000;

• Maximum depth of a graph. For example:

maxdepth=20;

• Maximum references in a graph between objects. For example:

maxrefs=500;

• Maximum number of bytes in a stream. For example:

maxbytes=500000;

Creating Custom Filters

Custom filters are filters you specify in your application’s code. They are set on an

individual stream or on all streams in a process. You can implement a custom filter as

a pattern, a method, a lambda expression, or a class.

Topics

• Reading a Stream of Serialized Objects

• Setting a Custom Filter for an Individual Stream

• Setting a JVM-Wide Custom Filter

• Setting a Custom Filter Using a Pattern

• Setting a Custom Filter as a Class

• Setting a Custom Filter as a Method

• Creating a Filter with ObjectInputFilter Methods

Reading a Stream of Serialized Objects

You can set a custom filter on one

ObjectInputStream

, or, to apply the same filter to

every stream, set a JVM-wide filter. If an

ObjectInputStream

doesn’t have a filter

defined for it, the JVM-wide filter is called, if there is one.

While the stream is being decoded, the following actions occur:

• For each new object in the stream and before the object is instantiated and

deserialized, the filter is called when it encounters a class for the first time.

(Subsequent instances of the same class aren't filtered.)

Chapter 2

Creating Custom Filters

2-6

• For each class in the stream, the filter is called with the resolved class. It is called

separately for each supertype and interface in the stream.

• The filter can examine each class referenced in the stream, including the class of objects

to be created, supertypes of those classes, and their interfaces.

• For each array in the stream, whether it is an array of primitives, array of strings, or array

of objects, the filter is called with the array class and the array length.

• For each reference to an object already read from the stream, the filter is called so it can

check the depth, number of references, and stream length. The depth starts at 1 and

increases for each nested object and decreases when each nested call returns.

• The filter is not called for primitives or for java.lang.String instances that are

encoded concretely in the stream.

• The filter returns a status of accept, reject, or undecided.

• Filter actions are logged if logging is enabled.

Unless a filter rejects the object, the object is accepted.

Setting a Custom Filter for an Individual Stream

You can set a filter on an individual ObjectInputStream when the input to the stream is

untrusted and the filter has a limited set of classes or constraints to enforce. For example,

you could ensure that a stream only contains numbers, strings, and other application-

specified types.

A custom filter is set using the setObjectInputFilter method. The custom filter must be

set before objects are read from the stream.

In the following example, the setObjectInputFilter method is invoked with the

dateTimeFilter

method. This filter only accepts classes from the java.time package. The

dateTimeFilter

method is defined in a code sample in Setting a Custom Filter as a Method.

LocalDateTime readDateTime(InputStream is) throws IOException {

try (ObjectInputStream ois = new ObjectInputStream(is)) {

ois.setObjectInputFilter(FilterClass::dateTimeFilter);

return (LocalDateTime) ois.readObject();

} catch (ClassNotFoundException ex) {

IOException ioe = new StreamCorruptedException("class missing");

ioe.initCause(ex);

throw ioe;

}

Setting a JVM-Wide Custom Filter

You can set a JVM-wide filter that applies to every use of ObjectInputStream unless it is

overridden on a specific stream. If you can identify every type and condition that is needed by

the entire application, the filter can allow those and reject the rest. Typically, JVM-wide filters

are used to reject specific classes or packages, or to limit array sizes, graph depth, or total

graph size.

Chapter 2

Creating Custom Filters

2-7

A JVM-wide filter is set once using the methods of the

ObjectInputFilter.Config class. The filter can be an instance of a class, a

lambda expression, a method reference, or a pattern.

ObjectInputFilter filter = ...

ObjectInputFilter.Config.setSerialFilter(filter);

In the following example, the JVM-wide filter is set by using a lambda expression.

ObjectInputFilter.Config.setSerialFilter(

info -> info.depth() > 10 ? Status.REJECTED : Status.UNDECIDED);

In the following example, the JVM-wide filter is set by using a method reference:

ObjectInputFilter.Config.setSerialFilter(FilterClass::dateTimeFilter);

Setting a Custom Filter Using a Pattern

A pattern-based custom filter, which is convenient for simple cases, can be created by

using the ObjectInputFilter.Config.createFilter method. You can create a

pattern-based filter as a system property or Security Property. Implementing a pattern-

based filter as a method or a lambda expression gives you more flexibility.

The filter patterns can accept or reject specific names of classes, packages, and

modules and can place limits on array sizes, graph depth, total references, and stream

size. Patterns cannot match the names of the supertype or interfaces of the class.

In the following example, the filter allows

example.File

and rejects

example.Directory

ObjectInputFilter filesOnlyFilter =

ObjectInputFilter.Config.createFilter("example.File;!

example.Directory");

This example allows only

example.File

. All other class names are rejected.

ObjectInputFilter filesOnlyFilter =

ObjectInputFilter.Config.createFilter("example.File;!*");

Setting a Custom Filter as a Class

A custom filter can be implemented as a class implementing the

java.io.ObjectInputFilter interface, as a lambda expression, or as a method.

A filter is typically stateless and performs checks solely on the input parameters.

However, you may implement a filter that, for example, maintains state between calls

to the

checkInput

method to count artifacts in the stream.

Chapter 2

Creating Custom Filters

2-8

In the following example, the

FilterNumber

class allows any object that is an instance of the

Number

class and rejects all others.

class FilterNumber implements ObjectInputFilter {

public Status checkInput(FilterInfo filterInfo) {

Class<?> clazz = filterInfo.serialClass();

if (clazz != null) {

return (Number.class.isAssignableFrom(clazz))

? ObjectInputFilter.Status.ALLOWED

: ObjectInputFilter.Status.REJECTED;

}

return ObjectInputFilter.Status.UNDECIDED;

}

In the example:

• The

checkInput

method accepts an

ObjectInputFilter.FilterInfo

object. The object’s

methods provide access to the class to be checked, array size, current depth, number of

references to existing objects, and stream size read so far.

• If

serialClass

is not null, then the value is checked to see if the class of the object is

Number

. If so, it is accepted and returns

ObjectInputFilter.Status.ALLOWED

. Otherwise,

it is rejected and returns

ObjectInputFilter.Status.REJECTED

• Any other combination of arguments returns

ObjectInputFilter.Status.UNDECIDED

Deserialization continues, and any remaining filters are run until the object is accepted or

rejected. If there are no other filters, the object is accepted.

Setting a Custom Filter as a Method

A custom filter can also be implemented as a method. The method reference is used instead

of an inline lambda expression.

The

dateTimeFilter

method that is defined in the following example is used by the code

sample in Setting a Custom Filter for an Individual Stream.

public class FilterClass {

static ObjectInputFilter.Status

dateTimeFilter(ObjectInputFilter.FilterInfo info) {

Class<?> serialClass = info.serialClass();

if (serialClass != null) {

return serialClass.getPackageName().equals("java.time")

? ObjectInputFilter.Status.ALLOWED

: ObjectInputFilter.Status.REJECTED;

}

return ObjectInputFilter.Status.UNDECIDED;

}

This custom filter allows only the classes found in the base module of the JDK:

static ObjectInputFilter.Status

baseFilter(ObjectInputFilter.FilterInfo info) {

Chapter 2

Creating Custom Filters

2-9

Class<?> serialClass = info.serialClass();

if (serialClass != null) {

return

serialClass.getModule().getName().equals("java.base")

? ObjectInputFilter.Status.ALLOWED

: ObjectInputFilter.Status.REJECTED;

}

return ObjectInputFilter.Status.UNDECIDED;

}

Creating a Filter with ObjectInputFilter Methods

The

ObjectInputFilter

interface includes the following static methods that enable

you to quickly create filters:

• allowFilter(Predicate<Class<?>>, ObjectInputFilter.Status)

• rejectFilter(Predicate<Class<?>>, ObjectInputFilter.Status)

• rejectUndecidedClass(ObjectInputFilter)

• merge(ObjectInputFilter, ObjectInputFilter)

The allowFilter method creates a filter based on a

Predicate

that takes a

Class

as its argument. The created filter returns

ObjectInputFilter.Status.ALLOWED

if the

predicate is true. Otherwise, it returns the value of the

allowFilter

method’s second

argument. The following creates a filter that accepts the

Integer

class. All other

classes are considered undecided:

ObjectInputFilter intFilter = ObjectInputFilter.allowFilter(

cl -> cl.equals(Integer.class),

ObjectInputFilter.Status.UNDECIDED);

The rejectFilter method is the inverse of

allowFilter

: It creates a filter based on

a Predicate that takes a Class as its argument. The created filter returns

ObjectInputFilter.Status.REJECTED if the predicate is true. Otherwise, it

returns the value of the rejectFilter method’s second argument. The following

creates a filter that rejects any class loaded from the application class loader:

ObjectInputFilter f = ObjectInputFilter.rejectFilter(cl ->

cl.getClassLoader() == ClassLoader.getSystemClassLoader(),

Status.UNDECIDED);

The

rejectUndecidedClass

method creates a new filter based on an existing filter by

rejecting any class that the existing filter considers as undecided. The following

creates a filter based on

intFilter

. It accepts the

Integer

class but rejects all other

(undecided) classes:

ObjectInputFilter rejectUndecidedFilter =

ObjectInputFilter.rejectUndecidedClass(intFilter);

Chapter 2

Creating Custom Filters

2-10

剩余156页未读，继续阅读

weixin_40191861_zj

粉丝: 83
资源: 1万+

Java平台标准版核心库：JDK19开发者指南

JDK19-javadoc-guide.pdf

JDK17-java-core-libraries-developer-guide.pdf

JDK18-java-core-libraries-developer-guide.pdf

JDK11-java-core-libraries-developer-guide.pdf

JDK14-java-core-libraries-developer-guide.pdf

JDK13-java-core-libraries-developer-guide.pdf

jdk20-java-core-libraries-developer-guide.pdf

JDK16-java-core-libraries-developer-guide.pdf

JDK15-java-core-libraries-developer-guide.pdf

JDK 12 Documentation - Java Core Libraries Developer Guide

最新资源