rzo1 commented on code in PR #1185:
URL: https://github.com/apache/opennlp/pull/1185#discussion_r3607898893
##########
opennlp-core/opennlp-runtime/src/main/java/opennlp/tools/util/model/BaseModel.java:
##########
@@ -687,9 +688,48 @@ private void writeObject(ObjectOutputStream out) throws
IOException {
this.serialize(out);
}
+ /**
+ * Allowlist for classes that may legitimately appear while deserializing a
+ * {@link BaseModel} via the standard {@link Serializable} mechanism.
Mirrors the
+ * {@code ObjectInputFilter} convention already used by other serializable
model
+ * types in this project (e.g. {@code
SvmDoccatModel#deserialize(InputStream)}).
+ */
+ private static final ObjectInputFilter DESERIALIZE_FILTER =
ObjectInputFilter.Config.createFilter(
Review Comment:
Static fields are never part of the serialized form, and per the Java Object
Serialization Spec, adding methods or static fields is a compatible change that
doesn't affect the serialized stream at all, cf.
https://docs.oracle.com/en/java/javase/21/docs/specs/serialization/version.html#compatible-changes
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
