Package org.aoju.bus.core.io.stream
Class ObjectInputStream
java.lang.Object
java.io.InputStream
java.io.ObjectInputStream
org.aoju.bus.core.io.stream.ObjectInputStream
- All Implemented Interfaces:
Closeable,DataInput,ObjectInput,ObjectStreamConstants,AutoCloseable
带有类验证的对象流,用于避免反序列化漏洞
- Since:
- Java 17+
- Author:
- Kimi Liu
-
Nested Class Summary
Nested classes/interfaces inherited from class java.io.ObjectInputStream
ObjectInputStream.GetField -
Field Summary
Fields inherited from interface java.io.ObjectStreamConstants
baseWireHandle, PROTOCOL_VERSION_1, PROTOCOL_VERSION_2, SC_BLOCK_DATA, SC_ENUM, SC_EXTERNALIZABLE, SC_SERIALIZABLE, SC_WRITE_METHOD, SERIAL_FILTER_PERMISSION, STREAM_MAGIC, STREAM_VERSION, SUBCLASS_IMPLEMENTATION_PERMISSION, SUBSTITUTION_PERMISSION, TC_ARRAY, TC_BASE, TC_BLOCKDATA, TC_BLOCKDATALONG, TC_CLASS, TC_CLASSDESC, TC_ENDBLOCKDATA, TC_ENUM, TC_EXCEPTION, TC_LONGSTRING, TC_MAX, TC_NULL, TC_OBJECT, TC_PROXYCLASSDESC, TC_REFERENCE, TC_RESET, TC_STRING -
Constructor Summary
Constructors -
Method Summary
Modifier and TypeMethodDescriptionvoid接受反序列化的类,用于反序列化验证void禁止反序列化的类,用于反序列化验证protected Class<?> 只允许反序列化SerialObject classMethods inherited from class java.io.ObjectInputStream
available, close, defaultReadObject, enableResolveObject, getObjectInputFilter, read, read, readBoolean, readByte, readChar, readClassDescriptor, readDouble, readFields, readFloat, readFully, readFully, readInt, readLine, readLong, readObject, readObjectOverride, readShort, readStreamHeader, readUnshared, readUnsignedByte, readUnsignedShort, readUTF, registerValidation, resolveObject, resolveProxyClass, setObjectInputFilter, skipBytesMethods inherited from class java.io.InputStream
mark, markSupported, nullInputStream, read, readAllBytes, readNBytes, readNBytes, reset, skip, skipNBytes, transferToMethods inherited from class java.lang.Object
clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, waitMethods inherited from interface java.io.ObjectInput
read, skip
-
Constructor Details
-
ObjectInputStream
构造- Parameters:
inputStream- 流acceptClasses- 白名单的类- Throws:
IOException- IO异常
-
-
Method Details
-
refuse
禁止反序列化的类,用于反序列化验证- Parameters:
refuseClasses- 禁止反序列化的类
-
accept
接受反序列化的类,用于反序列化验证- Parameters:
acceptClasses- 接受反序列化的类
-
resolveClass
只允许反序列化SerialObject class- Overrides:
resolveClassin classObjectInputStream- Throws:
IOExceptionClassNotFoundException
-