Class CamelObjectInputStream

java.lang.Object

java.io.InputStream

java.io.ObjectInputStream

org.apache.camel.support.CamelObjectInputStream

All Implemented Interfaces:

Closeable, DataInput, ObjectInput, ObjectStreamConstants, AutoCloseable

public class CamelObjectInputStream
extends ObjectInputStream

An ObjectInputStream that resolves classes against the Camel application classloader and installs a JEP-290 ObjectInputFilter while reading, as a defense-in-depth measure against unsafe deserialization.

As this is the shared stream used by Camel deserialization consumers, the filter is applied by default so that every caller inherits it. When no explicit pattern is supplied the JVM-wide jdk.serialFilter is honoured if set, otherwise DeserializationFilterHelper.DEFAULT_DESERIALIZATION_FILTER is applied.

Nested Class Summary

Nested classes/interfaces inherited from class ObjectInputStream

ObjectInputStream.GetField

Field Summary

Fields inherited from interface ObjectStreamConstants

baseWireHandle, PROTOCOL_VERSION_1, PROTOCOL_VERSION_2, SC_BLOCK_DATA, SC_ENUM, SC_EXTERNALIZABLE, SC_SERIALIZABLE, SC_WRITE_METHOD, SERIAL_FILTER_PERMISSION, STREAM_MAGIC, STREAM_VERSION, SUBCLASS_IMPLEMENTATION_PERMISSION, SUBSTITUTION_PERMISSION, TC_ARRAY, TC_BASE, TC_BLOCKDATA, TC_BLOCKDATALONG, TC_CLASS, TC_CLASSDESC, TC_ENDBLOCKDATA, TC_ENUM, TC_EXCEPTION, TC_LONGSTRING, TC_MAX, TC_NULL, TC_OBJECT, TC_PROXYCLASSDESC, TC_REFERENCE, TC_RESET, TC_STRING

Constructor Summary

Constructors

Constructor	Description
CamelObjectInputStream(InputStream in, org.apache.camel.CamelContext context)
CamelObjectInputStream(InputStream in, org.apache.camel.CamelContext context, String deserializationFilter)	Creates a CamelObjectInputStream that applies a JEP-290 ObjectInputFilter while reading.

Method Summary

Modifier and Type	Method	Description
protected Class<?>	resolveClass(ObjectStreamClass desc)

Methods inherited from class ObjectInputStream

available, close, defaultReadObject, enableResolveObject, getObjectInputFilter, read, read, readBoolean, readByte, readChar, readClassDescriptor, readDouble, readFields, readFloat, readFully, readFully, readInt, readLine, readLong, readObject, readObjectOverride, readShort, readStreamHeader, readUnshared, readUnsignedByte, readUnsignedShort, readUTF, registerValidation, resolveObject, resolveProxyClass, setObjectInputFilter, skipBytes

Methods inherited from class InputStream

mark, markSupported, nullInputStream, read, readAllBytes, readNBytes, readNBytes, reset, skip, skipNBytes, transferTo

Methods inherited from class Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Methods inherited from interface ObjectInput

read, skip

Constructor Details

CamelObjectInputStream

public CamelObjectInputStream(InputStream in,
 org.apache.camel.CamelContext context)
                       throws IOException

Throws:

IOException

CamelObjectInputStream

public CamelObjectInputStream(InputStream in,
 org.apache.camel.CamelContext context,
 String deserializationFilter)
                       throws IOException

Creates a CamelObjectInputStream that applies a JEP-290 ObjectInputFilter while reading.

Parameters:

in - the input stream to read from

context - the camel context used to resolve the application classloader; may be null

deserializationFilter - an ObjectInputFilter pattern (same syntax as jdk.serialFilter) to apply; when null or blank the JVM-wide jdk.serialFilter is used if present, otherwise DeserializationFilterHelper.DEFAULT_DESERIALIZATION_FILTER is applied

Throws:

IOException - if an I/O error occurs while reading the stream header

Since:

4.22

Method Details

resolveClass

protected Class<?> resolveClass(ObjectStreamClass desc)
                         throws ClassNotFoundException,
IOException

Overrides:

resolveClass in class ObjectInputStream

Throws:

ClassNotFoundException

IOException