Java SE 11核心库开发者指南

需积分: 10 45 浏览量更新于2024-07-15 收藏 748KB PDF 举报

"JDK 11 的文档是 Java 核心库开发者指南，涵盖了 Java Platform, Standard Edition 的核心库，版本号为 Release 11。这份文档由 Oracle 和其关联公司版权所有，根据特定的许可协议提供，包含使用和披露的限制，并受知识产权法律保护。文档禁止未经授权的复制、修改和分发，除非许可协议或法律规定允许。对于软件的逆向工程、拆解或反编译，除非为了兼容性目的而被法律要求，否则是禁止的。文档内容可能会在未经通知的情况下变更，且不保证无误。如果发现任何错误，建议以书面形式报告给 Oracle。此外，该软件或文档如交付给美国政府或任何代表美国政府进行许可的人，将适用特定的美国政府用户条款。" JDK 11 是 Java 开发工具包的一个重要版本，它包含了运行 Java 应用程序所需的所有组件，包括 Java 运行时环境（JRE）、编译器（javac）和其他开发工具。Java Core Libraries 是 JDK 的核心组成部分，它们提供了编写 Java 应用的基础 API，包括核心类库，如集合框架、输入/输出(I/O)、网络编程、多线程、反射、日期与时间API等。 1. **集合框架**：在 JDK 11 中，集合框架继续提供 ArrayList、LinkedList、HashSet、HashMap 等数据结构。Java 8 引入的流（Stream）API 在 JDK 11 中得到进一步优化，支持更多的操作和并行处理，使得对集合的处理更加高效和简洁。 2. **I/O 和 NIO**：Java I/O API 支持文件读写、串行化、网络通信等。NIO（New Input/Output）提供了非阻塞I/O，适用于高并发的系统。JDK 11 对此进行了改进，例如引入了新的文件通道（FileChannel）特性，增强了文件操作的性能。 3. **多线程**：Java 提供了 Thread 类和 ExecutorService 接口来实现多线程。在 JDK 11 中，线程管理和同步机制保持稳定，但可能有一些小的性能优化和bug修复。 4. **反射**：反射允许在运行时检查和修改程序的行为。在 JDK 11 中，反射API继续提供动态类型和元数据访问的功能，同时保证安全性和稳定性。 5. **日期与时间API**：自 Java 8 开始，引入了新的日期和时间 API（java.time 包），取代了旧的 java.util.Date 和 java.util.Calendar。JDK 11 继续提供这些API，用于处理日期、时间、时区等，提供了更友好的API和更精确的计算。 6. **网络编程**：Java 提供了 Socket 和 ServerSocket 类来处理网络通信。JDK 11 可能对网络API进行了优化，以适应现代网络应用的需求。 7. **模块系统**：JDK 9 引入了模块系统（Project Jigsaw），JDK 11 中这一特性更为成熟，允许开发者更好地组织和封装代码，提高代码的可维护性和安全性。 8. **安全性**：JDK 11 对 Java 安全模型进行了改进，加强了加密算法的支持，提供了更安全的默认配置。 9. **字符串与字符集**：Java 字符串（String）类是不可变的，提供了丰富的操作方法。JDK 11 可能对字符串处理进行了优化，以提高性能。 10. **垃圾收集与内存管理**：Java 的自动内存管理依赖于垃圾收集器，JDK 11 中可能包含对垃圾收集策略的优化，以减少停顿时间和提高整体性能。 JDK 11 的 Java Core Libraries Developer Guide 为开发者提供了全面的指南，帮助他们理解和利用 Java 平台的核心功能，从而编写出高效、稳定的代码。无论是新手还是经验丰富的开发者，都可以从中获益。

The previous example filter accepts all other classes, not just those in

example.somepackage.*

. To reject all other classes, add

jdk.serialFilter=!example.somepackage.SomeClass;example.somepackage.*;!*

Define a Resource Limit Filter

A resource filter limits graph complexity and size. You can create filters for the

following parameters to control the resource usage for each application:

• Maximum allowed array size. For example:

maxarray=100000;

• Maximum depth of a graph. For example:

maxdepth=20;

• Maximum references in a graph between objects. For example:

maxrefs=500;

• Maximum number of bytes in a stream. For example:

maxbytes=500000;

Creating Custom Filters

Custom filters are filters you specify in your application’s code. They are set on an

individual stream or on all streams in a process. You can implement a custom filter as

a pattern, a method, a lambda expression, or a class.

Reading a Stream of Serialized Objects

You can set a custom filter on one

ObjectInputStream

, or, to apply the same filter to

every stream, set a process-wide filter. If an

ObjectInputStream

doesn’t have a filter

defined for it, the process-wide filter is called, if there is one.

While the stream is being decoded, the following actions occur:

• For each new object in the stream, the filter is called before the object is

instantiated and deserialized.

• For each class in the stream, the filter is called with the resolved class. It is called

separately for each supertype and interface in the stream.

• The filter can examine each class referenced in the stream, including the class of

objects to be created, supertypes of those classes, and their interfaces.

• For each array in the stream, whether it is an array of primitives, array of strings,

or array of objects, the filter is called with the array class and the array length.

• For each reference to an object already read from the stream, the filter is called so

it can check the depth, number of references, and stream length. The depth starts

at 1 and increases for each nested object and decreases when each nested call

returns.

• The filter is not called for primitives or for java.lang.String instances that are

encoded concretely in the stream.

• The filter returns a status of accept, reject, or undecided.

• Filter actions are logged if logging is enabled.

Unless a filter rejects the object, the object is accepted.

Chapter 2

Creating Custom Filters

2-5

Setting a Custom Filter for an Individual Stream

You can set a filter on an individual ObjectInputStream when the input to the

stream is untrusted and the filter has a limited set of classes or constraints to enforce.

For example, you could ensure that a stream only contains numbers, strings, and

other application-specified types.

A custom filter is set using the setObjectInputFilter method. The custom filter

must be set before objects are read from the stream.

In the following example, the setObjectInputFiltermethod is invoked with the

dateTimeFilter

method. This filter only accepts classes from the java.time

package. The

dateTimeFilter

method is defined in a code sample in Setting a

Custom Filter as a Method.

LocalDateTime readDateTime(InputStream is) throws IOException {

try (ObjectInputStream ois = new ObjectInputStream(is)) {

ois.setObjectInputFilter(FilterClass::dateTimeFilter);

return (LocalDateTime) ois.readObject();

} catch (ClassNotFoundException ex) {

IOException ioe = new StreamCorruptedException("class

missing");

ioe.initCause(ex);

throw ioe;

}

Setting a Process-Wide Custom Filter

You can set a process-wide filter that applies to every use of ObjectInputStream

unless it is overridden on a specific stream. If you can identify every type and condition

that is needed by the entire application, the filter can allow those and reject the rest.

Typically, process-wide filters are used to reject specific classes or packages, or to

limit array sizes, graph depth, or total graph size.

A process-wide filter is set once using the methods of the

ObjectInputFilter.Config class. The filter can be an instance of a class, a

lambda expression, a method reference, or a pattern.

ObjectInputFilter filter = ...

ObjectInputFilter.Config.setSerialFilter(filter);

In the following example, the process-wide filter is set by using a lambda expression.

ObjectInputFilter.Config.setSerialFilter(info -> info.depth() > 10 ?

Status.REJECTED : Status.UNDECIDED);

In the following example, the process-wide filter is set by using an instance of a class.

ObjectInputFilter.Config.setSerialFilter(FilterClass::dateTimeFilter);

Chapter 2

Creating Custom Filters

2-6

Setting a Custom Filter Using a Pattern

A pattern-based custom filter, which is convenient for simple cases, can be created by

using the ObjectInputFilter.Config.createFilter method. You can create a

pattern-based filter as a system property or Security Property. Implementing a pattern-

based filter as a method or a lambda expression gives you more flexibility.

The filter patterns can accept or reject specific classes, packages, modules, and can

place limits on array sizes, graph depth, total references, and stream size. Patterns

cannot match the supertype or interfaces of the class.

In the following example, the filter allows

example.File

and rejects

example.Directory

classes.

ObjectInputFilter filesOnlyFilter =

ObjectInputFilter.Config.createFilter("example.File;!example.Directory");

This example allows only

example.File

. All other classes are rejected.

ObjectInputFilter filesOnlyFilter =

ObjectInputFilter.Config.createFilter("example.File;!*");

Setting a Custom Filter as a Class

A custom filter can be implemented as a class implementing the

java.io.ObjectInputFilter interface, as a lambda expression, or as a method.

A filter is typically stateless and performs checks solely on the input parameters.

However, you may implement a filter that, for example, maintains state between calls

to the

checkInput

method to count artifacts in the stream.

In the following example, the

FilterNumber

class allows any object that is an instance

of the

Number

class and rejects all others.

class FilterNumber implements ObjectInputFilter {

public Status checkInput(FilterInfo filterInfo) {

Class<?> clazz = filterInfo.serialClass();

if (clazz != null) {

return (Number.class.isAssignableFrom(clazz)) ?

Status.ALLOWED : Status.REJECTED;

}

return Status.UNDECIDED;

}

In the example:

• The

checkInput

method accepts an

ObjectInputFilter.FilterInfo

object. The

object’s methods provide access to the class to be checked, array size, current

depth, number of references to existing objects, and stream size read so far.

• If

serialClass

is not null, indicating that a new object is being created, the value is

checked to see if the class of the object is

Number

. If so, it is accepted, otherwise it

is rejected.

Chapter 2

Creating Custom Filters

2-7

剩余71页未读，继续阅读

星星舰队队长

粉丝: 4
资源: 26

Java SE 11核心库开发者指南

JavaDocumentation

JDK 12 Documentation - Java Core Libraries Developer Guide

JDK16-java-core-libraries-developer-guide.pdf

JDK14-java-core-libraries-developer-guide.pdf

JDK17-java-core-libraries-developer-guide.pdf

JDK13-java-core-libraries-developer-guide.pdf

JDK15-java-core-libraries-developer-guide.pdf

jdk20-java-core-libraries-developer-guide.pdf

JDK19-java-core-libraries-developer-guide.pdf

JDK19-security-developer-guide.pdf

最新资源