Class AllowListDeserializingConverter
java.lang.Object
org.springframework.integration.support.converter.AllowListDeserializingConverter
A
Converter that delegates to a
Deserializer to convert data in a byte
array to an object. By default, if using a DefaultDeserializer all
classes/packages are deserialized. If you receive data from untrusted sources, consider
adding trusted classes/packages using setAllowedPatterns(String...) or
addAllowedPatterns(String...).
If a delegate deserializer is a DefaultDeserializer, only its ClassLoader
is used for a ConfigurableObjectInputStream logic.
- Since:
- 5.4
- Author:
- Gary Russell, Mark Fisher, Juergen Hoeller, Artem Bilan
-
Constructor Summary
ConstructorsConstructorDescriptionCreate aAllowListDeserializingConverterwith defaultObjectInputStreamconfiguration, using the "latest user-defined ClassLoader".AllowListDeserializingConverter(ClassLoader classLoader) AllowListDeserializingConverter(Deserializer<Object> deserializer) Create aAllowListDeserializingConverterthat delegates to the providedDeserializer. -
Method Summary
Modifier and TypeMethodDescriptionvoidaddAllowedPatterns(String... patterns) Add package/class patterns to the allowed list.protected voidcheckAllowList(Class<?> clazz) convert(byte[] source) protected Objectdeserialize(ByteArrayInputStream inputStream) voidsetAllowedPatterns(String... allowedPatterns) Set simple patterns for allowable packages/classes for deserialization.
-
Constructor Details
-
AllowListDeserializingConverter
public AllowListDeserializingConverter()Create aAllowListDeserializingConverterwith defaultObjectInputStreamconfiguration, using the "latest user-defined ClassLoader". -
AllowListDeserializingConverter
- Parameters:
classLoader- the class loader to use for deserialization.
-
AllowListDeserializingConverter
Create aAllowListDeserializingConverterthat delegates to the providedDeserializer.- Parameters:
deserializer- the deserializer to use.
-
-
Method Details
-
setAllowedPatterns
Set simple patterns for allowable packages/classes for deserialization. The patterns will be applied in order until a match is found. A class can be fully qualified or a wildcard '*' is allowed at the beginning or end of the class name. Examples:com.foo.*,*.MyClass.- Parameters:
allowedPatterns- the patterns.
-
addAllowedPatterns
Add package/class patterns to the allowed list.- Parameters:
patterns- the patterns to add.- See Also:
-
convert
-
deserialize
- Throws:
IOException
-
checkAllowList
-