JDK 10 核心库官方文档：Java Platform SE 10 Release E91241-01 (2018年)

需积分: 5 55 浏览量更新于2024-06-22 收藏 525KB PDF 举报

身份认证购VIP最低享 7 折!

领优惠券(最高得80元）

资源详情

资源推荐

If a class doesn’t match any filter, then it is accepted. If you want to accept only certain

classes, then your filter must reject everything that doesn’t match. To reject all classes

other than those specified, include

as the last pattern in a class filter.

For a complete description of the syntax for the patterns, see the

conf/security/

java.security

file, or see JEP 290.

Pattern-Based Filter Limitations

Pattern-based filters are used for simple acceptance or rejection. These filters have

some limitations. For example:

• Patterns can’t allow different sizes of arrays based on the class.

• Patterns can’t match classes based on the supertype or interfaces of the class.

• Patterns have no state and can’t make choices depending on the earlier classes

deserialized in the stream.

Define a Pattern-Based Filter for One Application

You can define a pattern-based filter as a system property for one application. A

system property supersedes a Security Property value.

To create a filter that only applies to one application, and only to a single invocation of

Java, define the

jdk.serialFilter

system property in the command line.

The following example shows how to limit resource usage for an individual application:

java -

Djdk.serialFilter=maxarray=100000;maxdepth=20;maxrefs=500 com.example.test.Applicatio

Define a Pattern-Based Filter for All Applications in a Process

You can define a pattern-based filter as a Security Property, for all applications in a

process. A system property supersedes a Security Property value.

1. Edit the java.security properties file.

• JDK 9 and later: $JAVA_HOME/conf/security/java.security

• JDK 8,7,6: $JAVA_HOME/lib/security/java.security

2. Add the pattern to the

jdk.serialFilter

Security Property.

Define a Class Filter

You can create a pattern-based class filter that is applied globally. For example, the

pattern might be a class name or a package with wildcard.

In the following example, the filter rejects one class from a package (

example.somepackage.SomeClass

), and accepts all other classes in the package:

jdk.serialFilter=!example.somepackage.SomeClass;example.somepackage.*;

The previous example filter accepts all other classes, not just those in

example.somepackage.*

. To reject all other classes, add

jdk.serialFilter=!example.somepackage.SomeClass;example.somepackage.*;!*

Chapter 2

Creating Pattern-Based Filters

2-4

Define a Resource Limit Filter

A resource filter limits graph complexity and size. You can create filters for the

following parameters to control the resource usage for each application:

• Maximum allowed array size. For example:

maxarray=100000;

• Maximum depth of a graph. For example:

maxdepth=20;

• Maximum references in a graph between objects. For example:

maxrefs=500;

• Maximum number of bytes in a stream. For example:

maxbytes=500000;

Creating Custom Filters

Custom filters are filters you specify in your application’s code. They are set on an

individual stream or on all streams in a process. You can implement a custom filter as

a pattern, a method, a lambda expression, or a class.

Reading a Stream of Serialized Objects

You can set a custom filter on one

ObjectInputStream

, or, to apply the same filter to

every stream, set a process-wide filter. If an

ObjectInputStream

doesn’t have a filter

defined for it, the process-wide filter is called, if there is one.

While the stream is being decoded, the following actions occur:

• For each new object in the stream, the filter is called before the object is

instantiated and deserialized.

• For each class in the stream, the filter is called with the resolved class. It is called

separately for each supertype and interface in the stream.

• The filter can examine each class referenced in the stream, including the class of

objects to be created, supertypes of those classes, and their interfaces.

• For each array in the stream, whether it is an array of primitives, array of strings,

or array of objects, the filter is called with the array class and the array length.

• For each reference to an object already read from the stream, the filter is called so

it can check the depth, number of references, and stream length. The depth starts

at 1 and increases for each nested object and decreases when each nested call

returns.

• The filter is not called for primitives or for java.lang.String instances that are

encoded concretely in the stream.

• The filter returns a status of accept, reject, or undecided.

• Filter actions are logged if logging is enabled.

Unless a filter rejects the object, the object is accepted.

Setting a Custom Filter for an Individual Stream

You can set a filter on an individual ObjectInputStream when the input to the

stream is untrusted and the filter has a limited set of classes or constraints to enforce.

For example, you could ensure that a stream only contains numbers, strings, and

other application-specified types.

Chapter 2

Creating Custom Filters

2-5

A custom filter is set using the setObjectInputFilter method. The custom filter

must be set before objects are read from the stream.

In the following example, the setObjectInputFiltermethod is invoked with the

dateTimeFilter

method. This filter only accepts classes from the java.time package.

The

dateTimeFilter

method is defined in a code sample in Setting a Custom Filter as a

Method.

LocalDateTime readDateTime(InputStream is) throws IOException {

try (ObjectInputStream ois = new ObjectInputStream(is)) {

ois.setObjectInputFilter(FilterClass::dateTimeFilter);

return (LocalDateTime) ois.readObject();

} catch (ClassNotFoundException ex) {

IOException ioe = new StreamCorruptedException("class missing");

ioe.initCause(ex);

throw ioe;

}

Setting a Process-Wide Custom Filter

You can set a process-wide filter that applies to every use of ObjectInputStream

unless it is overridden on a specific stream. If you can identify every type and condition

that is needed by the entire application, the filter can allow those and reject the rest.

Typically, process-wide filters are used to reject specific classes or packages, or to

limit array sizes, graph depth, or total graph size.

A process-wide filter is set once using the methods of the

ObjectInputFilter.Config class. The filter can be an instance of a class, a

lambda expression, a method reference, or a pattern.

ObjectInputFilter filter = ...

ObjectInputFilter.Config.setSerialFilter(filter);

In the following example, the process-wide filter is set by using a lambda expression.

ObjectInputFilter.Config.setSerialFilter(info -> info.depth() > 10 ?

Status.REJECTED : Status.UNDECIDED);

In the following example, the process-wide filter is set by using an instance of a class.

ObjectInputFilter.Config.setSerialFilter(FilterClass::dateTimeFilter);

Setting a Custom Filter Using a Pattern

A pattern-based custom filter, which is convenient for simple cases, can be created by

using the ObjectInputFilter.Config.createFilter method. You can create a

pattern-based filter as a system property or Security Property. Implementing a pattern-

based filter as a method or a lambda expression gives you more flexibility.

The filter patterns can accept or reject specific classes, packages, modules, and can

place limits on array sizes, graph depth, total references, and stream size. Patterns

cannot match the supertype or interfaces of the class.

In the following example, the filter allows

example.File

and rejects

example.Directory

classes.

ObjectInputFilter filesOnlyFilter =

ObjectInputFilter.Config.createFilter("example.File;!example.Directory");

This example allows only

example.File

. All other classes are rejected.

Chapter 2

Creating Custom Filters

2-6

剩余58页未读，继续阅读

weixin_40191861_zj

粉丝: 68
资源: 1万+

会员权益专享

JDK 10 核心库官方文档：Java Platform SE 10 Release E91241-01 (2018年)

JDK10-Java Platform, Standard Edition ,Tools Reference-328.pdf

3、安装和配置JDK rpm -qa|grep openjdk packages中jdk-8u211-linux-x64.tar.gz cd /opt/packages tar -zxvf jdk-8u211-linux-x64.tar.gz -C /opt/programs vi /etc/profile export JAVA_HOME=/opt/programs/jdk1.8.0_211 export PATH=$PATH:$JAVA_HOME/bin source /etc/profile java -version写注释

bcprov-jdk14-145.jar

NOTE: Picked up JDK_JAVA_OPTIONS: --add-opens=java.base/java.lang=ALL-UNNAMED --add-opens=java.rmi/sun.rmi.transport=ALL-UNNAMED

单元测试报错 NOTE: Picked up JDK_JAVA_OPTIONS: --add-opens=java.base/java.lang=ALL-UNNAMED --add-opens=java.base/java.io=ALL-UNNAMED --add-opens=java.base/java.util=ALL-UNNAMED --add-opens=java.base/java.util.concurrent=ALL-UNNAMED --add-opens=java.rmi/sun.rmi. 该怎么办

jdk-linux-x64.tar.gz

bcprov-jdk16-1.46.jar has unsigned entries - org/bouncycastle/LICENSE.class

jdk6-windows-i586

aspose-words-19.3-jdk17.jar-java

picked up jdk_java_options: --add-opens=java.base/java.lang=all-unnamed --add-opens=java.base/java.io=all-unnamed --add-opens=java.base/java.util=all-unnamed --add-opens=java.base/java.util.concurrent=all-unnamed --add-opens=java.rmi/sun.rmi.transport=all-unnamed

note: picked up jdk_java_options: --add-opens=java.base/java.lang=all-unnamed --add-opens=java.base/java.io=all-unnamed --add-opens=java.rmi/sun.rmi.transport=all-unnamed

jdk-8u311-linux-x64.tar.gz

jdk-8u371-linux-x64.tar.gz下载

jdk1.8.0-371下载

note: picked up jdk_java_options: --add-opens=java.base/java.lang=all-unnamed --add-opens=java.base

服务器虚拟化部署方案.doc

北京市东城区人民法院服务器项目.doc

求集合数据的均方差iction-mast开发笔记

会员权益专享

最新资源