Java SE 20 Core Libraries Developer Guide: Release 20 - March 2023

需积分: 5 38 浏览量更新于2024-06-22 收藏 939KB PDF 举报

"《Java平台，标准版核心库开发指南》（Java Platform, Standard Edition Core Libraries - 163）是Oracle公司于2023年3月发布的第20版官方文档，该版本适用于Java Standard Edition。此文档详细介绍了Java的核心库，这些库构成了Java平台的基础，为开发者提供了丰富的类库支持，包括集合框架、I/O处理、网络编程、多线程、异常处理和安全功能等。文档强调了版权保护，所有内容受Oracle及其关联公司的知识产权法律保护，用户在使用时必须遵守许可协议中的规定，不得进行未经许可的复制、修改、分发或公开展示，除非法律另有要求或者有明确的授权。此外，文档指出软件可能包含错误，用户在发现任何问题时应向Oracle提交书面报告以便及时修复。值得注意的是，如果文档涉及的软件、文档或数据被提供给美国政府或由其代表进行许可，那么它可能会受到联邦采购法规的约束，可能需要遵循特定的合同条款和政府保密要求。在Java 20的Core Libraries中，开发者可以找到诸如`java.util`包下的集合类（如ArrayList, HashMap），`java.io`包下的文件和输入输出操作，`java.net`包的网络编程工具，`java.lang`包中的基本类型和异常处理机制，以及`java.security`包的加密和安全功能等。这些库的设计目标是为开发者提供高度稳定且功能强大的API，以支持高效、安全的应用程序开发。学习和使用这份指南对于理解和优化Java应用程序的性能、保证代码质量以及遵循最佳实践至关重要。同时，随着新版本的发布，开发者还需关注Java语言和库的更新，确保他们的代码能够与最新技术保持兼容并充分利用新特性。" 这份文档不仅为Java开发者提供了实用的技术参考，也是理解Java平台架构和技术演进的重要参考资料。通过深入研究和实践，开发者能够提升编程技能，更好地构建适应现代需求的软件解决方案。

In the following example, the filter rejects one class name from a package (

example.somepackage.SomeClass

), and allows all other class names in the package:

jdk.serialFilter=!example.somepackage.SomeClass;example.somepackage.*;

The previous example filter allows all other class names, not just those in

example.somepackage.*

. To reject all other class names, add

jdk.serialFilter=!example.somepackage.SomeClass;example.somepackage.*;!

Define a Resource Limit Filter

A resource filter limits graph complexity and size. You can create filters for the

following parameters to control the resource usage for each application:

• Maximum allowed array size. For example:

maxarray=100000;

• Maximum depth of a graph. For example:

maxdepth=20;

• Maximum references in a graph between objects. For example:

maxrefs=500;

• Maximum number of bytes in a stream. For example:

maxbytes=500000;

Creating Custom Filters

Custom filters are filters you specify in your application’s code. They are set on an

individual stream or on all streams in a process. You can implement a custom filter as

a pattern, a method, a lambda expression, or a class.

Topics

• Reading a Stream of Serialized Objects

• Setting a Custom Filter for an Individual Stream

• Setting a JVM-Wide Custom Filter

• Setting a Custom Filter Using a Pattern

• Setting a Custom Filter as a Class

• Setting a Custom Filter as a Method

• Creating a Filter with ObjectInputFilter Methods

Reading a Stream of Serialized Objects

You can set a custom filter on one

ObjectInputStream

, or, to apply the same filter to

every stream, set a JVM-wide filter. If an

ObjectInputStream

doesn’t have a filter

defined for it, the JVM-wide filter is called, if there is one.

While the stream is being decoded, the following actions occur:

• For each new object in the stream and before the object is instantiated and

deserialized, the filter is called when it encounters a class for the first time.

(Subsequent instances of the same class aren't filtered.)

Chapter 2

Creating Custom Filters

2-6

• For each class in the stream, the filter is called with the resolved class. It is called

separately for each supertype and interface in the stream.

• The filter can examine each class referenced in the stream, including the class of objects

to be created, supertypes of those classes, and their interfaces.

• For each array in the stream, whether it is an array of primitives, array of strings, or array

of objects, the filter is called with the array class and the array length.

• For each reference to an object already read from the stream, the filter is called so it can

check the depth, number of references, and stream length. The depth starts at 1 and

increases for each nested object and decreases when each nested call returns.

• The filter is not called for primitives or for java.lang.String instances that are

encoded concretely in the stream.

• The filter returns a status of accept, reject, or undecided.

• Filter actions are logged if logging is enabled.

Unless a filter rejects the object, the object is accepted.

Setting a Custom Filter for an Individual Stream

You can set a filter on an individual ObjectInputStream when the input to the stream is

untrusted and the filter has a limited set of classes or constraints to enforce. For example,

you could ensure that a stream only contains numbers, strings, and other application-

specified types.

A custom filter is set using the setObjectInputFilter method. The custom filter must be

set before objects are read from the stream.

In the following example, the setObjectInputFilter method is invoked with the

dateTimeFilter

method. This filter only accepts classes from the java.time package. The

dateTimeFilter

method is defined in a code sample in Setting a Custom Filter as a Method.

LocalDateTime readDateTime(InputStream is) throws IOException {

try (ObjectInputStream ois = new ObjectInputStream(is)) {

ois.setObjectInputFilter(FilterClass::dateTimeFilter);

return (LocalDateTime) ois.readObject();

} catch (ClassNotFoundException ex) {

IOException ioe = new StreamCorruptedException("class missing");

ioe.initCause(ex);

throw ioe;

}

Setting a JVM-Wide Custom Filter

You can set a JVM-wide filter that applies to every use of ObjectInputStream unless it is

overridden on a specific stream. If you can identify every type and condition that is needed by

the entire application, the filter can allow those and reject the rest. Typically, JVM-wide filters

are used to reject specific classes or packages, or to limit array sizes, graph depth, or total

graph size.

Chapter 2

Creating Custom Filters

2-7

A JVM-wide filter is set once using the methods of the

ObjectInputFilter.Config class. The filter can be an instance of a class, a

lambda expression, a method reference, or a pattern.

ObjectInputFilter filter = ...

ObjectInputFilter.Config.setSerialFilter(filter);

In the following example, the JVM-wide filter is set by using a lambda expression.

ObjectInputFilter.Config.setSerialFilter(

info -> info.depth() > 10 ? Status.REJECTED : Status.UNDECIDED);

In the following example, the JVM-wide filter is set by using a method reference:

ObjectInputFilter.Config.setSerialFilter(FilterClass::dateTimeFilter);

Setting a Custom Filter Using a Pattern

A pattern-based custom filter, which is convenient for simple cases, can be created by

using the ObjectInputFilter.Config.createFilter method. You can create a

pattern-based filter as a system property or Security Property. Implementing a pattern-

based filter as a method or a lambda expression gives you more flexibility.

The filter patterns can accept or reject specific names of classes, packages, and

modules and can place limits on array sizes, graph depth, total references, and stream

size. Patterns cannot match the names of the supertype or interfaces of the class.

In the following example, the filter allows

example.File

and rejects

example.Directory

ObjectInputFilter filesOnlyFilter =

ObjectInputFilter.Config.createFilter("example.File;!

example.Directory");

This example allows only

example.File

. All other class names are rejected.

ObjectInputFilter filesOnlyFilter =

ObjectInputFilter.Config.createFilter("example.File;!*");

Setting a Custom Filter as a Class

A custom filter can be implemented as a class implementing the

java.io.ObjectInputFilter interface, as a lambda expression, or as a method.

A filter is typically stateless and performs checks solely on the input parameters.

However, you may implement a filter that, for example, maintains state between calls

to the

checkInput

method to count artifacts in the stream.

Chapter 2

Creating Custom Filters

2-8

In the following example, the

FilterNumber

class allows any object that is an instance of the

Number

class and rejects all others.

class FilterNumber implements ObjectInputFilter {

public Status checkInput(FilterInfo filterInfo) {

Class<?> clazz = filterInfo.serialClass();

if (clazz != null) {

return (Number.class.isAssignableFrom(clazz))

? ObjectInputFilter.Status.ALLOWED

: ObjectInputFilter.Status.REJECTED;

}

return ObjectInputFilter.Status.UNDECIDED;

}

In the example:

• The

checkInput

method accepts an

ObjectInputFilter.FilterInfo

object. The object’s

methods provide access to the class to be checked, array size, current depth, number of

references to existing objects, and stream size read so far.

• If

serialClass

is not null, then the value is checked to see if the class of the object is

Number

. If so, it is accepted and returns

ObjectInputFilter.Status.ALLOWED

. Otherwise,

it is rejected and returns

ObjectInputFilter.Status.REJECTED

• Any other combination of arguments returns

ObjectInputFilter.Status.UNDECIDED

Deserialization continues, and any remaining filters are run until the object is accepted or

rejected. If there are no other filters, the object is accepted.

Setting a Custom Filter as a Method

A custom filter can also be implemented as a method. The method reference is used instead

of an inline lambda expression.

The

dateTimeFilter

method that is defined in the following example is used by the code

sample in Setting a Custom Filter for an Individual Stream.

public class FilterClass {

static ObjectInputFilter.Status

dateTimeFilter(ObjectInputFilter.FilterInfo info) {

Class<?> serialClass = info.serialClass();

if (serialClass != null) {

return serialClass.getPackageName().equals("java.time")

? ObjectInputFilter.Status.ALLOWED

: ObjectInputFilter.Status.REJECTED;

}

return ObjectInputFilter.Status.UNDECIDED;

}

This custom filter allows only the classes found in the base module of the JDK:

static ObjectInputFilter.Status

baseFilter(ObjectInputFilter.FilterInfo info) {

Chapter 2

Creating Custom Filters

2-9

Class<?> serialClass = info.serialClass();

if (serialClass != null) {

return

serialClass.getModule().getName().equals("java.base")

? ObjectInputFilter.Status.ALLOWED

: ObjectInputFilter.Status.REJECTED;

}

return ObjectInputFilter.Status.UNDECIDED;

}

Creating a Filter with ObjectInputFilter Methods

The

ObjectInputFilter

interface includes the following static methods that enable

you to quickly create filters:

• allowFilter(Predicate<Class<?>>, ObjectInputFilter.Status)

• rejectFilter(Predicate<Class<?>>, ObjectInputFilter.Status)

• rejectUndecidedClass(ObjectInputFilter)

• merge(ObjectInputFilter, ObjectInputFilter)

The allowFilter method creates a filter based on a

Predicate

that takes a

Class

as its argument. The created filter returns

ObjectInputFilter.Status.ALLOWED

if the

predicate is true. Otherwise, it returns the value of the

allowFilter

method’s second

argument. The following creates a filter that accepts the

Integer

class. All other

classes are considered undecided:

ObjectInputFilter intFilter = ObjectInputFilter.allowFilter(

cl -> cl.equals(Integer.class),

ObjectInputFilter.Status.UNDECIDED);

The rejectFilter method is the inverse of

allowFilter

: It creates a filter based on

a Predicate that takes a Class as its argument. The created filter returns

ObjectInputFilter.Status.REJECTED if the predicate is true. Otherwise, it

returns the value of the rejectFilter method’s second argument. The following

creates a filter that rejects any class loaded from the application class loader:

ObjectInputFilter f = ObjectInputFilter.rejectFilter(cl ->

cl.getClassLoader() == ClassLoader.getSystemClassLoader(),

Status.UNDECIDED);

The

rejectUndecidedClass

method creates a new filter based on an existing filter by

rejecting any class that the existing filter considers as undecided. The following

creates a filter based on

intFilter

. It accepts the

Integer

class but rejects all other

(undecided) classes:

ObjectInputFilter rejectUndecidedFilter =

ObjectInputFilter.rejectUndecidedClass(intFilter);

Chapter 2

Creating Custom Filters

2-10

剩余162页未读，继续阅读

weixin_40191861_zj

粉丝: 80
资源: 1万+

Java SE 20 Core Libraries Developer Guide: Release 20 - March 20...

最新资源

Java SE 20 Core Libraries Developer Guide: Release 20 - March 20...

jdk20--jdk-javadoc-guide.pdf

jdk20-java-accessibility-guide.pdf

bcprov-jdk14-145.jar

单元测试报错 NOTE: Picked up JDK_JAVA_OPTIONS: --add-opens=java.base/java.lang=ALL-UNNAMED --add-opens=java.base/java.io=ALL-UNNAMED --add-opens=java.base/java.util=ALL-UNNAMED --add-opens=java.base/java.util.concurrent=ALL-UNNAMED --add-opens=java.rmi/sun.rmi. 该怎么办

3、安装和配置JDK rpm -qa|grep openjdk packages中jdk-8u211-linux-x64.tar.gz cd /opt/packages tar -zxvf jdk-8u211-linux-x64.tar.gz -C /opt/programs vi /etc/profile export JAVA_HOME=/opt/programs/jdk1.8.0_211 export PATH=$PATH:$JAVA_HOME/bin source /etc/profile java -version写注释

JAVA_OPTS="$JAVA_OPTS --add-exports=java.base/jdk.internal.ref=ALL-UNNAMED --add-opens=java.base/java.lang=ALL-UNNAMED" 这个参数怎么设置

NOTE: Picked up JDK_JAVA_OPTIONS: --add-opens=java.base/java.lang=ALL-UNNAMED --add-opens=java.rmi/sun.rmi.transport=ALL-UNNAMED

jdk-8.0.302.8-hotspot和jdk1.8区别

aspose-words-19.3-jdk17.jar-java

最新资源