Hi Roger,
Does setting jdk.serialFilter with Security.setProperty() work, or must
it only be pre-configured in the java.security file?
--Sean
On 1/24/20 2:51 PM, Roger Riggs wrote:
Please review a doc change in the description of the initialization of
the jdk.serialFilter from
a system property to generalize it beyond only command line invocation.
diff a/src/java.base/share/classes/java/io/ObjectInputFilter.java
b/src/java.base/share/classes/java/io/ObjectInputFilter.java
--- a/src/java.base/share/classes/java/io/ObjectInputFilter.java
+++ b/src/java.base/share/classes/java/io/ObjectInputFilter.java
@@ -204,15 +204,14 @@
* When setting the filter, it should be stateless and idempotent,
* reporting the same result when passed the same arguments.
* <p>
* The filter is configured during the initialization of the
{@code ObjectInputFilter.Config}
* class. For example, by calling {@link #getSerialFilter()
Config.getSerialFilter}.
- * If the system property {@systemProperty jdk.serialFilter} is
defined on the command line,
- * it is used to configure the filter.
- * If the system property is not defined on the command line, and
the
- * {@link java.security.Security} property {@code
jdk.serialFilter} is defined
- * then it is used to configure the filter.
+ * If the Java virtual machine is started with the system property
+ * {@systemProperty jdk.serialFilter}, its value is used to
configure the filter.
+ * If the system property is not defined, and the {@link
java.security.Security} property
+ * {@code jdk.serialFilter} is defined then it is used to
configure the filter.
* Otherwise, the filter is not configured during initialization and
* can be set with {@link #setSerialFilter(ObjectInputFilter)
Config.setSerialFilter}.
* Setting the {@code jdk.serialFilter} with {@link
System#setProperty(String, String)
* System.setProperty} <em>does not set the filter</em>.
Thanks, Roger
Issue:
https://bugs.openjdk.java.net/browse/JDK-8237651
Webrev:
http://cr.openjdk.java.net/~rriggs/webrev-filter-8237651/
