[CONF] Apache ActiveMQ > ObjectMessage

[Christopher L. Shannon (Confluence)]

Title: Message Title

Christopher L. Shannon edited a page

ObjectMessage ... ObjectMessage objects depend on Java serialization of marshal/unmarshal object payload. This process is generally considered unsafe as malicious payload can exploit the host system. That's why starting with version versions 5.12.2 and 5.13.0, ActiveMQ enforce enforces users to explicitly whitelist packages that can be exchanged using ObjectMessages. ... On the client side, you need to have this same mechanism as malicious code can be deserialized on ObjectMessage.getObject() call, compromising your application's environment. You can use the same configuration mechanism on the broker and configure trusted classes using system properties. However, this is usually not convenient in the client applications, so in 5.12.2 and 5.13.1 we introduced additional configuration mechanism using ActiveMQConnectionFactory. There are two additional methods defined: ... View page • Like

Stop watching space • Manage notifications This message was sent by Atlassian Confluence 5.8.4