Class DeserializationFilterHelper

java.lang.Object
org.apache.camel.support.DeserializationFilterHelper
public final class DeserializationFilterHelper extends Object
Helper for resolving the JEP-290 ObjectInputFilter that components apply when deserializing Java objects from potentially untrusted input (message payloads, persisted exchange state, and so on).

The resolution order is the same for every component:

  1. an explicitly configured filter pattern (typically a deserializationFilter endpoint or component option);
  2. the JVM-wide filter configured via the jdk.serialFilter system property or ObjectInputFilter.Config.setSerialFilter(ObjectInputFilter);
  3. a conservative Camel default.
Since:
4.22

  • Field Details

    • DEFAULT_DESERIALIZATION_FILTER

      public static final String DEFAULT_DESERIALIZATION_FILTER
      Default deserialization filter pattern applied while reading from an ObjectInputStream (via ObjectInputStream.setObjectInputFilter(ObjectInputFilter)). Denies java.net.**, allows other standard Java types and Apache Camel types, rejects everything else, and applies JEP-290 graph-shape limits (maxdepth, maxrefs, maxbytes) as defense-in-depth against resource-exhaustion payloads.
      See Also:

    • DEFAULT_CLASS_DESERIALIZATION_FILTER

      public static final String DEFAULT_CLASS_DESERIALIZATION_FILTER
      Default deserialization filter pattern for checking the class of an object that a third-party library has already deserialized, for example the payload returned by jakarta.jms.ObjectMessage#getObject(). Same allow-list as DEFAULT_DESERIALIZATION_FILTER but deliberately without the JEP-290 graph-shape limits: stream metrics such as depth, reference count and byte count are not available once deserialization has already happened, so including the limits would only advertise protection that can never be enforced.
      See Also:

  • Method Details

    • resolveDeserializationFilter

      public static ObjectInputFilter resolveDeserializationFilter(String configuredPattern)
      Resolves the deserialization filter to apply, falling back to DEFAULT_DESERIALIZATION_FILTER.
      Parameters:
      configuredPattern - the filter pattern configured on the component or endpoint, may be null or blank
      Returns:
      the filter to apply, never null

    • resolveDeserializationFilter

      public static ObjectInputFilter resolveDeserializationFilter(String configuredPattern, String defaultPattern)
      Resolves the deserialization filter to apply: the configured pattern when present, otherwise the JVM-wide filter (jdk.serialFilter) when set, otherwise the given default pattern.
      Parameters:
      configuredPattern - the filter pattern configured on the component or endpoint, may be null or blank
      defaultPattern - the default pattern to fall back to, must not be null
      Returns:
      the filter to apply, never null

    • checkClass

      public static ObjectInputFilter.Status checkClass(ObjectInputFilter filter, Class<?> clazz)
      Checks the class of an already-deserialized object against the given filter. This is for components where a third-party library performs the actual deserialization and Camel can only vet the result after the fact. Only the class is checked; JEP-290 graph-shape limits (maxdepth and friends) in the filter pattern cannot be evaluated in this mode, so resolve the filter with DEFAULT_CLASS_DESERIALIZATION_FILTER as the default.
      Parameters:
      filter - the filter to check against
      clazz - the class of the deserialized object
      Returns:
      the filter decision; callers should treat ObjectInputFilter.Status.REJECTED as fatal