RFR 9: JEP 290: Filter Incoming Serialization Data

Roger Riggs Roger.Riggs at Oracle.com
Tue Jul 19 14:02:44 UTC 2016

Please review the design, implementation, and tests of JEP 290: Filter 
Incoming Serialization Data[1]

It allows incoming streams of object-serialization data to be filtered 
in order to improve both security and robustness.
The JEP[1] has more detail on the background and scope.

The core mechanism is a filter interface implemented by serialization 
clients and set on an |ObjectInputStream|. The filter is called during 
the deserialization process to validate the classes being deserialized, 
the sizes of arrays being created, and metrics describing stream length, 
stream depth, and number of references as the stream is being decoded.

A process-wide filter can be configured that is applied to every 
The API of ObjectInputStream can be used to set a custom filter to 
supersede or augment the process-wide filter.



Javadoc (subset)

Comments appreciated, Roger

[1] JEP 290:   https://bugs.openjdk.java.net/browse/JDK-8154961

More information about the core-libs-dev mailing list