org.apache.river.api.io

Class DeSerializationPermission

java.lang.Object

java.security.Permission

java.security.BasicPermission

org.apache.river.api.io.DeSerializationPermission

All Implemented Interfaces:

Serializable, Guard

public class DeSerializationPermission
extends BasicPermission

Permission that when granted, allows de-serialization of an object. Only the protection domains of each class in an object hierarchy are tested, prior to construction. Any parameter objects have already been checked.

DeSerializationPermission is different to other permissions, where other Permissions guard something, and all domains on the call stack must have the Permission, DeSerializationPermission is only checked against the domains representing the class hierarchy of an object about to be de-serialized. It is about trusting the classes of the object to check all invariants while reading a stream from an untrusted source. This also allows a developer to utilize libraries, while minimizing the available classes that can participate in atomic de-serialization.

There are only four types:

• ATOMIC
• EXTERNALIZABLE
• MARSHALLED
• PROXY

Permissions should only be granted to domains that are trusted to read in a serial stream from an untrusted data source.

No permission is required for stateless objects that implement Serializable.

MARSHALLED - MarshalledObject allows any Serialized object to be transferred over a stream, it is often used to compare the serial form of objects, however because MarshalledObject allows any Serializable class to be deserialized, it would be unsafe to unmarshal a MarshalledObject instance, so this permission should only be granted for cases where MarshalledObject is not unmarshalled.

Since:

3.0.0

Author:

peter

See Also:

Serialized Form

Constructor Summary

Constructors

Constructor and Description
DeSerializationPermission(String type) The ProtectionDomain of a class that is de-serializing (reading object input) from an AtomicMarshalInputStream requires permission to do so.

Method Summary

Methods inherited from class java.security.BasicPermission

equals, getActions, hashCode, implies, newPermissionCollection

Methods inherited from class java.security.Permission

checkGuard, getName, toString

Methods inherited from class java.lang.Object

clone, finalize, getClass, notify, notifyAll, wait, wait, wait

Constructor Detail

DeSerializationPermission

public DeSerializationPermission(String type)

The ProtectionDomain of a class that is de-serializing (reading object input) from an AtomicMarshalInputStream requires permission to do so.

Parameters:

type - one of the following

• ATOMIC - Classes that implement AtomicSerial or AtomicExternal
• EXTERNALIZABLE - Classes that implement Externalizable
• MARSHALLED - MarshalledInstance or MarshalledObject
• PROXY - any class extending Proxy, dynamically generated proxy's already have this permission.