[GitHub] [geode] kirklund commented on a change in pull request #6962: GEODE-9758: Configure locator serialization filtering by default on Java 8

[GitBox]

kirklund commented on a change in pull request #6962:
URL: https://github.com/apache/geode/pull/6962#discussion_r740544013



##########
File path: 
geode-core/src/integrationTest/java/org/apache/geode/internal/io/LocatorJmxSerialFilterIntegrationTest.java
##########
@@ -151,15 +164,18 @@ public void 
startingLocatorWithJmxManager_skipsSerialFilter_atMostJava8() {
         .get()
         .start();
 
-    String serialFilter = System.getProperty(PROPERTY_NAME);
-    assertThat(serialFilter).isNull();
+    assertThat(isJmxManagerStarted())
+        .isTrue();
+    assertThat(System.getProperty(JMX_SERIAL_FILTER_PROPERTY))
+        .as(JMX_SERIAL_FILTER_PROPERTY)
+        .isNull();
   }
 
   @Test
-  public void 
startingLocatorWithJmxManager_skipsEmptySerialFilter_atMostJava8() {
-    assumeThat(isJavaVersionAtMost(JavaVersion.JAVA_1_8)).isTrue();
+  public void doesNotChangeEmptyJmxSerialFilter_onJava8() {

Review comment:
       Rename test to 
`doesNotConfigureJmxSerialFilter_whenPropertyIsEmpty_onJava8`

##########
File path: 
geode-core/src/integrationTest/java/org/apache/geode/internal/io/ServerSetSystemPropertyGlobalSerialFilterIntegrationTest.java
##########
@@ -0,0 +1,160 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one or more 
contributor license
+ * agreements. See the NOTICE file distributed with this work for additional 
information regarding
+ * copyright ownership. The ASF licenses this file to You under the Apache 
License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance with the 
License. You may obtain a
+ * copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software 
distributed under the License
+ * is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY 
KIND, either express
+ * or implied. See the License for the specific language governing permissions 
and limitations under
+ * the License.
+ */
+package org.apache.geode.internal.io;

Review comment:
       Move this class to package 
`org.apache.geode.internal.serialization.filter`. Keep it in the same module 
and same src set.

##########
File path: 
geode-core/src/integrationTest/java/org/apache/geode/internal/io/LocatorJmxSerialFilterIntegrationTest.java
##########
@@ -106,16 +113,19 @@ public void 
startingLocatorWithJmxManager_changesEmptySerialFilter_atLeastJava9(
         .get()
         .start();
 
-    String serialFilter = System.getProperty(PROPERTY_NAME);
-    assertThat(serialFilter).isEqualTo(expectedSerialFilter);
+    assertThat(isJmxManagerStarted())
+        .isTrue();
+    assertThat(System.getProperty(JMX_SERIAL_FILTER_PROPERTY))
+        .as(JMX_SERIAL_FILTER_PROPERTY)
+        .isEqualTo(openMBeanFilterPattern);
   }
 
   @Test
-  public void 
startingLocatorWithJmxManager_skipsNonEmptySerialFilter_atLeastJava9() {
-    assumeThat(isJavaVersionAtLeast(JavaVersion.JAVA_9)).isTrue();
+  public void doesNotChangeNonEmptyJmxSerialFilter_onJava9orGreater() {

Review comment:
       Rename this test to 
`doesNotChangeJmxSerialFilter_whenPropertyIsNotEmpty_onJava9orGreater`

##########
File path: 
geode-core/src/integrationTest/java/org/apache/geode/internal/io/ServerGlobalSerialFilterIntegrationTest.java
##########
@@ -0,0 +1,107 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one or more 
contributor license
+ * agreements. See the NOTICE file distributed with this work for additional 
information regarding
+ * copyright ownership. The ASF licenses this file to You under the Apache 
License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance with the 
License. You may obtain a
+ * copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software 
distributed under the License
+ * is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY 
KIND, either express
+ * or implied. See the License for the specific language governing permissions 
and limitations under
+ * the License.
+ */
+package org.apache.geode.internal.io;
+
+import static org.apache.commons.lang3.JavaVersion.JAVA_1_8;
+import static org.apache.commons.lang3.JavaVersion.JAVA_9;
+import static org.apache.commons.lang3.SystemUtils.isJavaVersionAtLeast;
+import static org.apache.commons.lang3.SystemUtils.isJavaVersionAtMost;
+import static 
org.apache.geode.distributed.ConfigurationProperties.HTTP_SERVICE_PORT;
+import static org.apache.geode.distributed.ConfigurationProperties.JMX_MANAGER;
+import static 
org.apache.geode.distributed.ConfigurationProperties.JMX_MANAGER_PORT;
+import static 
org.apache.geode.distributed.ConfigurationProperties.JMX_MANAGER_START;
+import static org.apache.geode.distributed.ConfigurationProperties.LOG_FILE;
+import static 
org.apache.geode.internal.AvailablePortHelper.getRandomAvailableTCPPort;
+import static org.assertj.core.api.Assertions.assertThat;
+import static org.assertj.core.api.Assumptions.assumeThat;
+
+import java.io.File;
+import java.io.IOException;
+
+import org.junit.Before;
+import org.junit.Rule;
+import org.junit.Test;
+import org.junit.contrib.java.lang.system.RestoreSystemProperties;
+import org.junit.rules.TemporaryFolder;
+
+import org.apache.geode.distributed.ServerLauncher;
+import org.apache.geode.test.junit.rules.CloseableReference;
+
+public class ServerGlobalSerialFilterIntegrationTest {
+
+  private static final String NAME = "server";
+  private static final String JDK_SERIAL_FILTER_PROPERTY = "jdk.serialFilter";
+
+  private File workingDirectory;
+  private int jmxPort;
+
+  @Rule
+  public CloseableReference<ServerLauncher> server = new 
CloseableReference<>();
+  @Rule
+  public RestoreSystemProperties restoreSystemProperties = new 
RestoreSystemProperties();
+  @Rule
+  public TemporaryFolder temporaryFolder = new TemporaryFolder();
+
+  @Before
+  public void setUp() throws IOException {
+    workingDirectory = temporaryFolder.newFolder(NAME);
+    jmxPort = getRandomAvailableTCPPort();
+  }
+
+  @Test
+  public void doesNotConfiguresJdkSerialFilter_onJava9orGreater() {
+    assumeThat(isJavaVersionAtLeast(JAVA_9)).isTrue();
+
+    server.set(new ServerLauncher.Builder()
+        .setMemberName(NAME)
+        .setDisableDefaultServer(true)
+        .setWorkingDirectory(workingDirectory.getAbsolutePath())
+        .set(HTTP_SERVICE_PORT, "0")
+        .set(JMX_MANAGER, "true")
+        .set(JMX_MANAGER_PORT, String.valueOf(jmxPort))
+        .set(JMX_MANAGER_START, "true")
+        .set(LOG_FILE, new File(workingDirectory, NAME + 
".log").getAbsolutePath())
+        .build())
+        .get()
+        .start();
+
+    assertThat(System.getProperty(JDK_SERIAL_FILTER_PROPERTY))
+        .as(JDK_SERIAL_FILTER_PROPERTY)
+        .isNull();
+  }
+
+  @Test
+  public void doesNotConfigureJdkSerialFilter_onJava8() {

Review comment:
       Rename test to `doesNotConfigureGlobalSerialFilter_onJava8`

##########
File path: 
geode-core/src/integrationTest/java/org/apache/geode/internal/io/ServerJmxSerialFilterIntegrationTest.java
##########
@@ -171,16 +187,19 @@ public void 
startingServerWithJmxManager_skipsEmptySerialFilter_atMostJava8() {
         .get()
         .start();
 
-    String serialFilter = System.getProperty(PROPERTY_NAME);
-    assertThat(serialFilter).isEqualTo("");
+    assertThat(isJmxManagerStarted())
+        .isTrue();
+    assertThat(System.getProperty(JMX_SERIAL_FILTER_PROPERTY))
+        .as(JMX_SERIAL_FILTER_PROPERTY)
+        .isEqualTo("");
   }
 
   @Test
-  public void 
startingServerWithJmxManager_skipsNonEmptySerialFilter_atMostJava8() {
-    assumeThat(isJavaVersionAtMost(JavaVersion.JAVA_1_8)).isTrue();
+  public void doesNotChangeNonEmptyJmxSerialFilter_onJava8() {

Review comment:
       Rename test to 
`doesNotConfigureJmxSerialFilter_whenPropertyIsNotEmpty_onJava8`

##########
File path: 
geode-core/src/integrationTest/java/org/apache/geode/internal/io/ServerSerializableObjectFilterIntegrationTest.java
##########
@@ -0,0 +1,252 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one or more 
contributor license
+ * agreements. See the NOTICE file distributed with this work for additional 
information regarding
+ * copyright ownership. The ASF licenses this file to You under the Apache 
License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance with the 
License. You may obtain a
+ * copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software 
distributed under the License
+ * is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY 
KIND, either express
+ * or implied. See the License for the specific language governing permissions 
and limitations under
+ * the License.
+ */
+package org.apache.geode.internal.io;
+
+import static org.apache.commons.lang3.JavaVersion.JAVA_1_8;
+import static org.apache.commons.lang3.JavaVersion.JAVA_9;
+import static org.apache.commons.lang3.SystemUtils.isJavaVersionAtLeast;
+import static org.apache.commons.lang3.SystemUtils.isJavaVersionAtMost;
+import static 
org.apache.geode.distributed.ConfigurationProperties.HTTP_SERVICE_PORT;
+import static org.apache.geode.distributed.ConfigurationProperties.JMX_MANAGER;
+import static 
org.apache.geode.distributed.ConfigurationProperties.JMX_MANAGER_PORT;
+import static 
org.apache.geode.distributed.ConfigurationProperties.JMX_MANAGER_START;
+import static org.apache.geode.distributed.ConfigurationProperties.LOG_FILE;
+import static 
org.apache.geode.distributed.ConfigurationProperties.SERIALIZABLE_OBJECT_FILTER;
+import static 
org.apache.geode.distributed.ConfigurationProperties.VALIDATE_SERIALIZABLE_OBJECTS;
+import static 
org.apache.geode.internal.AvailablePortHelper.getRandomAvailableTCPPort;
+import static org.assertj.core.api.Assertions.assertThat;
+import static org.assertj.core.api.Assumptions.assumeThat;
+
+import java.io.File;
+import java.io.Serializable;
+
+import org.junit.Before;
+import org.junit.Rule;
+import org.junit.Test;
+import org.junit.contrib.java.lang.system.RestoreSystemProperties;
+import org.junit.rules.TemporaryFolder;
+
+import org.apache.geode.cache.Cache;
+import org.apache.geode.distributed.ServerLauncher;
+import org.apache.geode.distributed.internal.DistributionConfig;
+import org.apache.geode.internal.AvailablePortHelper;
+import org.apache.geode.internal.cache.InternalCache;
+import org.apache.geode.management.ManagementService;
+import org.apache.geode.management.internal.SystemManagementService;
+import org.apache.geode.test.junit.rules.CloseableReference;
+
+public class ServerSerializableObjectFilterIntegrationTest {
+
+  private static final String NAME = "server";
+
+  private File workingDirectory;
+  private int jmxPort;
+
+  @Rule
+  public CloseableReference<ServerLauncher> server = new 
CloseableReference<>();
+  @Rule
+  public RestoreSystemProperties restoreSystemProperties = new 
RestoreSystemProperties();
+  @Rule
+  public TemporaryFolder temporaryFolder = new TemporaryFolder();
+
+  @Before
+  public void setUp() throws Exception {
+    workingDirectory = temporaryFolder.newFolder(NAME);
+    jmxPort = getRandomAvailableTCPPort();
+  }
+
+  @Test
+  public void doesNotConfigureValidateSerializableObjects_onJava9orGreater() {
+    assumeThat(isJavaVersionAtLeast(JAVA_9)).isTrue();
+    int serverPort = AvailablePortHelper.getRandomAvailableTCPPort();
+    server.set(new ServerLauncher.Builder()
+        .setMemberName(NAME)
+        .setWorkingDirectory(workingDirectory.getAbsolutePath())
+        .setServerPort(serverPort)
+        .set(HTTP_SERVICE_PORT, "0")
+        .set(JMX_MANAGER, "true")
+        .set(JMX_MANAGER_PORT, String.valueOf(jmxPort))
+        .set(JMX_MANAGER_START, "true")
+        .set(LOG_FILE, new File(workingDirectory, NAME + 
".log").getAbsolutePath())
+        .build())
+        .get()
+        .start();
+
+    assertThat(isJmxManagerStarted())
+        .isTrue();
+    assertThat(isValidateSerializableObjectsConfigured())
+        .as(VALIDATE_SERIALIZABLE_OBJECTS)
+        .isFalse();
+  }
+
+  @Test
+  public void doesNotConfigureSerializableObjectFilter_onJava9OrGreater() {
+    assumeThat(isJavaVersionAtLeast(JAVA_9)).isTrue();
+    int serverPort = AvailablePortHelper.getRandomAvailableTCPPort();
+    server.set(new ServerLauncher.Builder()
+        .setMemberName(NAME)
+        .setWorkingDirectory(workingDirectory.getAbsolutePath())
+        .setServerPort(serverPort)
+        .set(HTTP_SERVICE_PORT, "0")
+        .set(JMX_MANAGER, "true")
+        .set(JMX_MANAGER_PORT, String.valueOf(jmxPort))
+        .set(JMX_MANAGER_START, "true")
+        .set(LOG_FILE, new File(workingDirectory, NAME + 
".log").getAbsolutePath())
+        .build())
+        .get()
+        .start();
+
+    assertThat(isJmxManagerStarted())
+        .isTrue();
+    assertThat(getSerializableObjectFilter())
+        .as(SERIALIZABLE_OBJECT_FILTER)
+        .isEqualTo("!*");
+  }
+
+  @Test
+  public void doesNotConfigureValidateSerializableObjects_onJava8() {
+    assumeThat(isJavaVersionAtLeast(JAVA_9)).isTrue();
+    int serverPort = AvailablePortHelper.getRandomAvailableTCPPort();
+    server.set(new ServerLauncher.Builder()
+        .setMemberName(NAME)
+        .setWorkingDirectory(workingDirectory.getAbsolutePath())
+        .setServerPort(serverPort)
+        .set(HTTP_SERVICE_PORT, "0")
+        .set(JMX_MANAGER, "true")
+        .set(JMX_MANAGER_PORT, String.valueOf(jmxPort))
+        .set(JMX_MANAGER_START, "true")
+        .set(LOG_FILE, new File(workingDirectory, NAME + 
".log").getAbsolutePath())
+        .build())
+        .get()
+        .start();
+
+    assertThat(isJmxManagerStarted())
+        .isTrue();
+    assertThat(isValidateSerializableObjectsConfigured())
+        .as(VALIDATE_SERIALIZABLE_OBJECTS)
+        .isFalse();
+  }
+
+  @Test
+  public void doesNotConfigureSerializableObjectFilter_onJava8() {
+    assumeThat(isJavaVersionAtMost(JAVA_1_8)).isTrue();
+    int serverPort = AvailablePortHelper.getRandomAvailableTCPPort();
+    server.set(new ServerLauncher.Builder()
+        .setMemberName(NAME)
+        .setWorkingDirectory(workingDirectory.getAbsolutePath())
+        .setServerPort(serverPort)
+        .set(HTTP_SERVICE_PORT, "0")
+        .set(JMX_MANAGER, "true")
+        .set(JMX_MANAGER_PORT, String.valueOf(jmxPort))
+        .set(JMX_MANAGER_START, "true")
+        .set(LOG_FILE, new File(workingDirectory, NAME + 
".log").getAbsolutePath())
+        .build())
+        .get()
+        .start();
+
+    assertThat(isJmxManagerStarted())
+        .isTrue();
+    assertThat(getSerializableObjectFilter())
+        .as(SERIALIZABLE_OBJECT_FILTER)
+        .isEqualTo("!*");
+  }
+
+  @Test
+  public void userSpecifiedSerializableObjectFilter_onJava8() {

Review comment:
       Delete test. It's invalid within the context of `ServerLauncher` 
automatically configuring the serialization filter. We could move it to a new 
`SerializableObjectFilterIntegrationTest` in `org.apache.geode` package but 
only if you add `VALIDATE_SERIALIZABLE_OBJECTS` `true` to the configuration.

##########
File path: 
geode-core/src/main/java/org/apache/geode/internal/lang/SystemUtils.java
##########
@@ -50,6 +55,16 @@
 
   private static final String LINE_SEPARATOR = 
System.getProperty("line.separator");
 
+  /**
+   * Is the Java version the requested version.
+   *
+   * @param requiredVersion the required version
+   * @return true if the actual version is the required version
+   */
+  public static boolean isJavaVersion(final JavaVersion requiredVersion) {

Review comment:
       I'm leaning towards removing `isJavaVersion` and just have all callers 
use Apache Commons' JavaVersion directly.

##########
File path: 
geode-core/src/integrationTest/java/org/apache/geode/internal/io/ServerSetSystemPropertyGlobalSerialFilterIntegrationTest.java
##########
@@ -0,0 +1,160 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one or more 
contributor license
+ * agreements. See the NOTICE file distributed with this work for additional 
information regarding
+ * copyright ownership. The ASF licenses this file to You under the Apache 
License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance with the 
License. You may obtain a
+ * copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software 
distributed under the License
+ * is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY 
KIND, either express
+ * or implied. See the License for the specific language governing permissions 
and limitations under
+ * the License.
+ */
+package org.apache.geode.internal.io;
+
+import static org.apache.commons.lang3.JavaVersion.JAVA_1_8;
+import static org.apache.commons.lang3.JavaVersion.JAVA_9;
+import static org.apache.commons.lang3.SystemUtils.isJavaVersionAtLeast;
+import static org.apache.commons.lang3.SystemUtils.isJavaVersionAtMost;
+import static 
org.apache.geode.distributed.ConfigurationProperties.HTTP_SERVICE_PORT;
+import static org.apache.geode.distributed.ConfigurationProperties.JMX_MANAGER;
+import static 
org.apache.geode.distributed.ConfigurationProperties.JMX_MANAGER_PORT;
+import static 
org.apache.geode.distributed.ConfigurationProperties.JMX_MANAGER_START;
+import static org.apache.geode.distributed.ConfigurationProperties.LOG_FILE;
+import static 
org.apache.geode.internal.AvailablePortHelper.getRandomAvailableTCPPort;
+import static org.assertj.core.api.Assertions.assertThat;
+import static org.assertj.core.api.Assumptions.assumeThat;
+
+import java.io.File;
+import java.io.IOException;
+
+import org.junit.Before;
+import org.junit.Rule;
+import org.junit.Test;
+import org.junit.contrib.java.lang.system.RestoreSystemProperties;
+import org.junit.rules.TemporaryFolder;
+
+import org.apache.geode.distributed.ServerLauncher;
+import org.apache.geode.test.junit.rules.CloseableReference;
+
+public class ServerSetSystemPropertyGlobalSerialFilterIntegrationTest {
+
+  private static final String NAME = "server";
+  private static final String JDK_SERIAL_FILTER_PROPERTY = "jdk.serialFilter";
+
+  private File workingDirectory;
+  private int jmxPort;
+
+  @Rule
+  public CloseableReference<ServerLauncher> server = new 
CloseableReference<>();
+  @Rule
+  public RestoreSystemProperties restoreSystemProperties = new 
RestoreSystemProperties();
+  @Rule
+  public TemporaryFolder temporaryFolder = new TemporaryFolder();
+
+  @Before
+  public void setUp() throws IOException {
+    workingDirectory = temporaryFolder.newFolder(NAME);
+    jmxPort = getRandomAvailableTCPPort();
+  }
+
+  @Test
+  public void doesNotChangesEmptyJdkSerialFilter_onJava9orGreater() {

Review comment:
       Rename test to 
`doesNotConfigureGlobalSerialFilter_whenPropertyIsEmpty_onJava9orGreater`

##########
File path: 
geode-core/src/integrationTest/java/org/apache/geode/internal/io/LocatorGlobalSerialFilterPropertyExistsIntegrationTest.java
##########
@@ -0,0 +1,117 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one or more 
contributor license
+ * agreements. See the NOTICE file distributed with this work for additional 
information regarding
+ * copyright ownership. The ASF licenses this file to You under the Apache 
License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance with the 
License. You may obtain a
+ * copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software 
distributed under the License
+ * is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY 
KIND, either express
+ * or implied. See the License for the specific language governing permissions 
and limitations under
+ * the License.
+ */
+package org.apache.geode.internal.io;
+
+import static org.apache.commons.lang3.JavaVersion.JAVA_1_8;
+import static org.apache.commons.lang3.JavaVersion.JAVA_9;
+import static org.apache.commons.lang3.SystemUtils.isJavaVersionAtLeast;
+import static org.apache.commons.lang3.SystemUtils.isJavaVersionAtMost;
+import static 
org.apache.geode.distributed.ConfigurationProperties.HTTP_SERVICE_PORT;
+import static org.apache.geode.distributed.ConfigurationProperties.JMX_MANAGER;
+import static 
org.apache.geode.distributed.ConfigurationProperties.JMX_MANAGER_PORT;
+import static 
org.apache.geode.distributed.ConfigurationProperties.JMX_MANAGER_START;
+import static org.apache.geode.distributed.ConfigurationProperties.LOG_FILE;
+import static 
org.apache.geode.internal.AvailablePortHelper.getRandomAvailableTCPPorts;
+import static org.assertj.core.api.Assertions.assertThat;
+import static org.assertj.core.api.Assumptions.assumeThat;
+
+import java.io.File;
+import java.io.IOException;
+import java.lang.reflect.InvocationTargetException;
+
+import org.junit.Before;
+import org.junit.Rule;
+import org.junit.Test;
+import org.junit.contrib.java.lang.system.RestoreSystemProperties;
+import org.junit.rules.TemporaryFolder;
+
+import org.apache.geode.distributed.LocatorLauncher;
+import org.apache.geode.internal.serialization.filter.ObjectInputFilterApi;
+import 
org.apache.geode.internal.serialization.filter.ReflectionObjectInputFilterApiFactory;
+import org.apache.geode.test.junit.rules.CloseableReference;
+
+public class LocatorGlobalSerialFilterPropertyExistsIntegrationTest {
+
+  private static final String NAME = "locator";
+  private static final String JDK_SERIAL_FILTER_PROPERTY = "jdk.serialFilter";
+  private static final ObjectInputFilterApi OBJECT_INPUT_FILTER_API =
+      new ReflectionObjectInputFilterApiFactory().createObjectInputFilterApi();
+
+  private File workingDirectory;
+  private int locatorPort;
+  private int jmxPort;
+
+  @Rule
+  public CloseableReference<LocatorLauncher> locator = new 
CloseableReference<>();
+  @Rule
+  public RestoreSystemProperties restoreSystemProperties = new 
RestoreSystemProperties();
+  @Rule
+  public TemporaryFolder temporaryFolder = new TemporaryFolder();
+
+  @Before
+  public void setUp() throws IOException {
+    workingDirectory = temporaryFolder.newFolder(NAME);
+    int[] ports = getRandomAvailableTCPPorts(2);
+    jmxPort = ports[0];
+    locatorPort = ports[1];
+  }
+
+  @Test
+  public void setsSerialFilterWhenJdkSerialFilterPropertyIsSetToBlank_onJava8()
+      throws InvocationTargetException, IllegalAccessException {
+    assumeThat(isJavaVersionAtMost(JAVA_1_8)).isTrue();
+
+    System.setProperty(JDK_SERIAL_FILTER_PROPERTY, " ");
+
+    locator.set(new LocatorLauncher.Builder()
+        .setMemberName(NAME)
+        .setPort(locatorPort)
+        .setWorkingDirectory(workingDirectory.getAbsolutePath())
+        .set(HTTP_SERVICE_PORT, "0")
+        .set(JMX_MANAGER_PORT, String.valueOf(jmxPort))
+        .set(JMX_MANAGER_START, "true")
+        .set(LOG_FILE, new File(workingDirectory, NAME + 
".log").getAbsolutePath())
+        .build())
+        .get()
+        .start();
+
+    assertThat(OBJECT_INPUT_FILTER_API.getSerialFilter())
+        .as("ObjectInputFilter$Config.getSerialFilter()")
+        .isNotNull();
+  }
+
+  @Test
+  public void doesNotSetSerialFilterWhenSerialFilterIsNull_onJava9orGreater()
+      throws InvocationTargetException, IllegalAccessException {
+    assumeThat(isJavaVersionAtLeast(JAVA_9)).isTrue();
+
+    locator.set(new LocatorLauncher.Builder()
+        .setMemberName(NAME)
+        .setPort(locatorPort)
+        .setWorkingDirectory(workingDirectory.getAbsolutePath())
+        .set(HTTP_SERVICE_PORT, "0")
+        .set(JMX_MANAGER, "true")
+        .set(JMX_MANAGER_PORT, String.valueOf(jmxPort))
+        .set(JMX_MANAGER_START, "true")
+        .set(LOG_FILE, new File(workingDirectory, NAME + 
".log").getAbsolutePath())
+        .build())
+        .get()
+        .start();
+
+    assertThat(OBJECT_INPUT_FILTER_API.getSerialFilter())
+        .as("ObjectInputFilter$Config.getSerialFilter()")
+        .isNull();

Review comment:
       Add another TODO comment here

##########
File path: 
geode-core/src/integrationTest/java/org/apache/geode/internal/io/ServerJmxSerialFilterIntegrationTest.java
##########
@@ -12,8 +12,10 @@
  * or implied. See the License for the specific language governing permissions 
and limitations under
  * the License.
  */
-package org.apache.geode.management.internal;
+package org.apache.geode.internal.io;

Review comment:
       Move this class to package 
`org.apache.geode.internal.serialization.filter`. Keep it in the same module 
and same src set.

##########
File path: 
geode-core/src/integrationTest/java/org/apache/geode/internal/io/ServerSerializableObjectFilterIntegrationTest.java
##########
@@ -0,0 +1,252 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one or more 
contributor license
+ * agreements. See the NOTICE file distributed with this work for additional 
information regarding
+ * copyright ownership. The ASF licenses this file to You under the Apache 
License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance with the 
License. You may obtain a
+ * copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software 
distributed under the License
+ * is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY 
KIND, either express
+ * or implied. See the License for the specific language governing permissions 
and limitations under
+ * the License.
+ */
+package org.apache.geode.internal.io;

Review comment:
       Move this class to package 
`org.apache.geode.internal.serialization.filter`. Keep it in the same module 
and same src set.

##########
File path: 
geode-core/src/integrationTest/java/org/apache/geode/internal/io/ServerGlobalSerialFilterIntegrationTest.java
##########
@@ -0,0 +1,107 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one or more 
contributor license
+ * agreements. See the NOTICE file distributed with this work for additional 
information regarding
+ * copyright ownership. The ASF licenses this file to You under the Apache 
License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance with the 
License. You may obtain a
+ * copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software 
distributed under the License
+ * is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY 
KIND, either express
+ * or implied. See the License for the specific language governing permissions 
and limitations under
+ * the License.
+ */
+package org.apache.geode.internal.io;

Review comment:
       Move this class to package 
`org.apache.geode.internal.serialization.filter`. Keep it in the same module 
and same src set.

##########
File path: 
geode-gfsh/src/main/java/org/apache/geode/management/internal/cli/commands/StartLocatorCommand.java
##########
@@ -475,6 +475,12 @@ private void doOnConnectionFailure(final String 
locatorHostName, final int locat
       commandLine
           
.add("-D".concat(OSProcess.DISABLE_REDIRECTION_CONFIGURATION_PROPERTY).concat("=true"));
     }
+
+    // TODO:KIRK: alternative to LocatorLauncher.start changes
+    // commandLine.add("-Djdk.serialFilter=" + new 
SanctionedSerializablesFilterPattern()
+    // //.append(serializableObjectConfig.getFilterPatternIfEnabled())
+    // .pattern());
+

Review comment:
       Need to resolve this TODO

##########
File path: 
geode-core/src/integrationTest/java/org/apache/geode/internal/io/ServerJmxSerialFilterIntegrationTest.java
##########
@@ -22,50 +24,52 @@
 import static 
org.apache.geode.distributed.ConfigurationProperties.JMX_MANAGER_START;
 import static org.apache.geode.distributed.ConfigurationProperties.LOG_FILE;
 import static 
org.apache.geode.internal.AvailablePortHelper.getRandomAvailableTCPPort;
-import static 
org.apache.geode.management.internal.JmxRmiOpenTypesSerialFilter.PROPERTY_NAME;
 import static org.assertj.core.api.Assertions.assertThat;
 import static org.assertj.core.api.Assumptions.assumeThat;
 
 import java.io.File;
+import java.io.IOException;
 
-import org.apache.commons.lang3.JavaVersion;
-import org.junit.After;
 import org.junit.Before;
 import org.junit.Rule;
 import org.junit.Test;
+import org.junit.contrib.java.lang.system.RestoreSystemProperties;
 import org.junit.rules.TemporaryFolder;
 
+import org.apache.geode.cache.Cache;
 import org.apache.geode.distributed.ServerLauncher;
+import org.apache.geode.internal.serialization.filter.OpenMBeanFilterPattern;
+import org.apache.geode.management.ManagementService;
+import org.apache.geode.management.internal.SystemManagementService;
 import org.apache.geode.test.junit.rules.CloseableReference;
 
-public class ServerManagerConfiguresJmxSerialFilterIntegrationTest {
+public class ServerJmxSerialFilterIntegrationTest {

Review comment:
       Rename class to `ServerLauncherJmxSerialFilterIntegrationTest`

##########
File path: 
geode-core/src/integrationTest/java/org/apache/geode/internal/io/ServerGlobalSerialFilterIntegrationTest.java
##########
@@ -0,0 +1,107 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one or more 
contributor license
+ * agreements. See the NOTICE file distributed with this work for additional 
information regarding
+ * copyright ownership. The ASF licenses this file to You under the Apache 
License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance with the 
License. You may obtain a
+ * copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software 
distributed under the License
+ * is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY 
KIND, either express
+ * or implied. See the License for the specific language governing permissions 
and limitations under
+ * the License.
+ */
+package org.apache.geode.internal.io;
+
+import static org.apache.commons.lang3.JavaVersion.JAVA_1_8;
+import static org.apache.commons.lang3.JavaVersion.JAVA_9;
+import static org.apache.commons.lang3.SystemUtils.isJavaVersionAtLeast;
+import static org.apache.commons.lang3.SystemUtils.isJavaVersionAtMost;
+import static 
org.apache.geode.distributed.ConfigurationProperties.HTTP_SERVICE_PORT;
+import static org.apache.geode.distributed.ConfigurationProperties.JMX_MANAGER;
+import static 
org.apache.geode.distributed.ConfigurationProperties.JMX_MANAGER_PORT;
+import static 
org.apache.geode.distributed.ConfigurationProperties.JMX_MANAGER_START;
+import static org.apache.geode.distributed.ConfigurationProperties.LOG_FILE;
+import static 
org.apache.geode.internal.AvailablePortHelper.getRandomAvailableTCPPort;
+import static org.assertj.core.api.Assertions.assertThat;
+import static org.assertj.core.api.Assumptions.assumeThat;
+
+import java.io.File;
+import java.io.IOException;
+
+import org.junit.Before;
+import org.junit.Rule;
+import org.junit.Test;
+import org.junit.contrib.java.lang.system.RestoreSystemProperties;
+import org.junit.rules.TemporaryFolder;
+
+import org.apache.geode.distributed.ServerLauncher;
+import org.apache.geode.test.junit.rules.CloseableReference;
+
+public class ServerGlobalSerialFilterIntegrationTest {

Review comment:
       Rename class to `ServerLauncherGlobalSerialFilterIntegrationTest`

##########
File path: 
geode-core/src/integrationTest/java/org/apache/geode/internal/io/ServerJmxSerialFilterIntegrationTest.java
##########
@@ -103,16 +110,19 @@ public void 
startingServerWithJmxManager_changesEmptySerialFilter_atLeastJava9()
         .get()
         .start();
 
-    String serialFilter = System.getProperty(PROPERTY_NAME);
-    assertThat(serialFilter).isEqualTo(expectedSerialFilter);
+    assertThat(isJmxManagerStarted())
+        .isTrue();
+    assertThat(System.getProperty(JMX_SERIAL_FILTER_PROPERTY))
+        .as(JMX_SERIAL_FILTER_PROPERTY)
+        .isEqualTo(openMBeanFilterPattern);
   }
 
   @Test
-  public void 
startingServerWithJmxManager_skipsNonEmptySerialFilter_atLeastJava9() {
-    assumeThat(isJavaVersionAtLeast(JavaVersion.JAVA_9)).isTrue();
+  public void doesNotChangeNonEmptyJmxSerialFilter_onJava9orGreater() {

Review comment:
       Rename test to 
`doesNotChangeJmxSerialFilter_whenPropertyIsNotEmpty_onJava9orGreater`

##########
File path: 
geode-core/src/integrationTest/java/org/apache/geode/internal/io/ServerJmxSerialFilterIntegrationTest.java
##########
@@ -148,15 +161,18 @@ public void 
startingServerWithJmxManager_skipsSerialFilter_atMostJava8() {
         .get()
         .start();
 
-    String serialFilter = System.getProperty(PROPERTY_NAME);
-    assertThat(serialFilter).isNull();
+    assertThat(isJmxManagerStarted())
+        .isTrue();
+    assertThat(System.getProperty(JMX_SERIAL_FILTER_PROPERTY))
+        .as(JMX_SERIAL_FILTER_PROPERTY)
+        .isNull();
   }
 
   @Test
-  public void 
startingServerWithJmxManager_skipsEmptySerialFilter_atMostJava8() {
-    assumeThat(isJavaVersionAtMost(JavaVersion.JAVA_1_8)).isTrue();
+  public void doesNotChangeEmptyJmxSerialFilter_onJava8() {

Review comment:
       Rename test to 
`doesNotConfigureJmxSerialFilter_whenPropertyIsEmpty_onJava8`

##########
File path: 
geode-core/src/integrationTest/java/org/apache/geode/internal/io/ServerGlobalSerialFilterIntegrationTest.java
##########
@@ -0,0 +1,107 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one or more 
contributor license
+ * agreements. See the NOTICE file distributed with this work for additional 
information regarding
+ * copyright ownership. The ASF licenses this file to You under the Apache 
License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance with the 
License. You may obtain a
+ * copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software 
distributed under the License
+ * is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY 
KIND, either express
+ * or implied. See the License for the specific language governing permissions 
and limitations under
+ * the License.
+ */
+package org.apache.geode.internal.io;
+
+import static org.apache.commons.lang3.JavaVersion.JAVA_1_8;
+import static org.apache.commons.lang3.JavaVersion.JAVA_9;
+import static org.apache.commons.lang3.SystemUtils.isJavaVersionAtLeast;
+import static org.apache.commons.lang3.SystemUtils.isJavaVersionAtMost;
+import static 
org.apache.geode.distributed.ConfigurationProperties.HTTP_SERVICE_PORT;
+import static org.apache.geode.distributed.ConfigurationProperties.JMX_MANAGER;
+import static 
org.apache.geode.distributed.ConfigurationProperties.JMX_MANAGER_PORT;
+import static 
org.apache.geode.distributed.ConfigurationProperties.JMX_MANAGER_START;
+import static org.apache.geode.distributed.ConfigurationProperties.LOG_FILE;
+import static 
org.apache.geode.internal.AvailablePortHelper.getRandomAvailableTCPPort;
+import static org.assertj.core.api.Assertions.assertThat;
+import static org.assertj.core.api.Assumptions.assumeThat;
+
+import java.io.File;
+import java.io.IOException;
+
+import org.junit.Before;
+import org.junit.Rule;
+import org.junit.Test;
+import org.junit.contrib.java.lang.system.RestoreSystemProperties;
+import org.junit.rules.TemporaryFolder;
+
+import org.apache.geode.distributed.ServerLauncher;
+import org.apache.geode.test.junit.rules.CloseableReference;
+
+public class ServerGlobalSerialFilterIntegrationTest {
+
+  private static final String NAME = "server";
+  private static final String JDK_SERIAL_FILTER_PROPERTY = "jdk.serialFilter";
+
+  private File workingDirectory;
+  private int jmxPort;
+
+  @Rule
+  public CloseableReference<ServerLauncher> server = new 
CloseableReference<>();
+  @Rule
+  public RestoreSystemProperties restoreSystemProperties = new 
RestoreSystemProperties();
+  @Rule
+  public TemporaryFolder temporaryFolder = new TemporaryFolder();
+
+  @Before
+  public void setUp() throws IOException {
+    workingDirectory = temporaryFolder.newFolder(NAME);
+    jmxPort = getRandomAvailableTCPPort();
+  }
+
+  @Test
+  public void doesNotConfiguresJdkSerialFilter_onJava9orGreater() {

Review comment:
       Rename test to `doesNotConfigureGlobalSerialFilter_onJava9orGreater`

##########
File path: 
geode-core/src/integrationTest/java/org/apache/geode/internal/io/ServerJmxSerialFilterIntegrationTest.java
##########
@@ -80,15 +84,18 @@ public void 
startingServerWithJmxManager_configuresSerialFilter_atLeastJava9() {
         .get()
         .start();
 
-    String serialFilter = System.getProperty(PROPERTY_NAME);
-    assertThat(serialFilter).isEqualTo(expectedSerialFilter);
+    assertThat(isJmxManagerStarted())
+        .isTrue();
+    assertThat(System.getProperty(JMX_SERIAL_FILTER_PROPERTY))
+        .as(JMX_SERIAL_FILTER_PROPERTY)
+        .isEqualTo(openMBeanFilterPattern);
   }
 
   @Test
-  public void 
startingServerWithJmxManager_changesEmptySerialFilter_atLeastJava9() {
-    assumeThat(isJavaVersionAtLeast(JavaVersion.JAVA_9)).isTrue();
+  public void changesEmptyJmxSerialFilter_onJava9orGreater() {

Review comment:
       Rename test to 
`configuresJmxSerialFilter_whenPropertyIsEmpty_onJava9orGreater`

##########
File path: 
geode-junit/src/integrationTest/java/org/apache/geode/test/junit/internal/JUnitSanctionedSerializablesServiceIntegrationTest.java
##########
@@ -0,0 +1,40 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one or more 
contributor license
+ * agreements. See the NOTICE file distributed with this work for additional 
information regarding
+ * copyright ownership. The ASF licenses this file to You under the Apache 
License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance with the 
License. You may obtain a
+ * copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software 
distributed under the License
+ * is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY 
KIND, either express
+ * or implied. See the License for the specific language governing permissions 
and limitations under
+ * the License.
+ */
+package org.apache.geode.test.junit.internal;
+
+import org.junit.experimental.categories.Category;
+
+import 
org.apache.geode.codeAnalysis.SanctionedSerializablesServiceIntegrationTestBase;
+import org.apache.geode.internal.CoreSanctionedSerializablesService;
+import 
org.apache.geode.internal.serialization.filter.SanctionedSerializablesService;
+import org.apache.geode.test.junit.categories.SanctionedSerializablesTest;
+import org.apache.geode.test.junit.categories.SerializationTest;
+
+@Category({SerializationTest.class, SanctionedSerializablesTest.class})
+public class JUnitSanctionedSerializablesServiceIntegrationTest
+    extends SanctionedSerializablesServiceIntegrationTestBase {
+
+  private final SanctionedSerializablesService service = new 
CoreSanctionedSerializablesService();

Review comment:
       This should change to:
   ```
   private final SanctionedSerializablesService service = new 
JUnitSanctionedSerializablesService();
   ```

##########
File path: 
geode-core/src/integrationTest/java/org/apache/geode/internal/io/ServerSerializableObjectFilterIntegrationTest.java
##########
@@ -0,0 +1,252 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one or more 
contributor license
+ * agreements. See the NOTICE file distributed with this work for additional 
information regarding
+ * copyright ownership. The ASF licenses this file to You under the Apache 
License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance with the 
License. You may obtain a
+ * copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software 
distributed under the License
+ * is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY 
KIND, either express
+ * or implied. See the License for the specific language governing permissions 
and limitations under
+ * the License.
+ */
+package org.apache.geode.internal.io;
+
+import static org.apache.commons.lang3.JavaVersion.JAVA_1_8;
+import static org.apache.commons.lang3.JavaVersion.JAVA_9;
+import static org.apache.commons.lang3.SystemUtils.isJavaVersionAtLeast;
+import static org.apache.commons.lang3.SystemUtils.isJavaVersionAtMost;
+import static 
org.apache.geode.distributed.ConfigurationProperties.HTTP_SERVICE_PORT;
+import static org.apache.geode.distributed.ConfigurationProperties.JMX_MANAGER;
+import static 
org.apache.geode.distributed.ConfigurationProperties.JMX_MANAGER_PORT;
+import static 
org.apache.geode.distributed.ConfigurationProperties.JMX_MANAGER_START;
+import static org.apache.geode.distributed.ConfigurationProperties.LOG_FILE;
+import static 
org.apache.geode.distributed.ConfigurationProperties.SERIALIZABLE_OBJECT_FILTER;
+import static 
org.apache.geode.distributed.ConfigurationProperties.VALIDATE_SERIALIZABLE_OBJECTS;
+import static 
org.apache.geode.internal.AvailablePortHelper.getRandomAvailableTCPPort;
+import static org.assertj.core.api.Assertions.assertThat;
+import static org.assertj.core.api.Assumptions.assumeThat;
+
+import java.io.File;
+import java.io.Serializable;
+
+import org.junit.Before;
+import org.junit.Rule;
+import org.junit.Test;
+import org.junit.contrib.java.lang.system.RestoreSystemProperties;
+import org.junit.rules.TemporaryFolder;
+
+import org.apache.geode.cache.Cache;
+import org.apache.geode.distributed.ServerLauncher;
+import org.apache.geode.distributed.internal.DistributionConfig;
+import org.apache.geode.internal.AvailablePortHelper;
+import org.apache.geode.internal.cache.InternalCache;
+import org.apache.geode.management.ManagementService;
+import org.apache.geode.management.internal.SystemManagementService;
+import org.apache.geode.test.junit.rules.CloseableReference;
+
+public class ServerSerializableObjectFilterIntegrationTest {

Review comment:
       Rename class to `ServerLauncherSerializableObjectFilterIntegrationTest`

##########
File path: 
geode-core/src/integrationTest/java/org/apache/geode/internal/io/LocatorJmxSerialFilterIntegrationTest.java
##########
@@ -174,16 +190,19 @@ public void 
startingLocatorWithJmxManager_skipsEmptySerialFilter_atMostJava8() {
         .get()
         .start();
 
-    String serialFilter = System.getProperty(PROPERTY_NAME);
-    assertThat(serialFilter).isEqualTo("");
+    assertThat(isJmxManagerStarted())
+        .isTrue();
+    assertThat(System.getProperty(JMX_SERIAL_FILTER_PROPERTY))
+        .as(JMX_SERIAL_FILTER_PROPERTY)
+        .isEqualTo("");
   }
 
   @Test
-  public void 
startingLocatorWithJmxManager_skipsNonEmptySerialFilter_atMostJava8() {
-    assumeThat(isJavaVersionAtMost(JavaVersion.JAVA_1_8)).isTrue();
+  public void doesNotChangeNonEmptyJmxSerialFilter_onJava8() {

Review comment:
       Rename test to 
`doesNotConfigureJmxSerialFilter_whenPropertyIsNotEmpty_onJava8`

##########
File path: 
geode-core/src/integrationTest/java/org/apache/geode/internal/io/ServerSetSystemPropertyGlobalSerialFilterIntegrationTest.java
##########
@@ -0,0 +1,160 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one or more 
contributor license
+ * agreements. See the NOTICE file distributed with this work for additional 
information regarding
+ * copyright ownership. The ASF licenses this file to You under the Apache 
License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance with the 
License. You may obtain a
+ * copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software 
distributed under the License
+ * is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY 
KIND, either express
+ * or implied. See the License for the specific language governing permissions 
and limitations under
+ * the License.
+ */
+package org.apache.geode.internal.io;
+
+import static org.apache.commons.lang3.JavaVersion.JAVA_1_8;
+import static org.apache.commons.lang3.JavaVersion.JAVA_9;
+import static org.apache.commons.lang3.SystemUtils.isJavaVersionAtLeast;
+import static org.apache.commons.lang3.SystemUtils.isJavaVersionAtMost;
+import static 
org.apache.geode.distributed.ConfigurationProperties.HTTP_SERVICE_PORT;
+import static org.apache.geode.distributed.ConfigurationProperties.JMX_MANAGER;
+import static 
org.apache.geode.distributed.ConfigurationProperties.JMX_MANAGER_PORT;
+import static 
org.apache.geode.distributed.ConfigurationProperties.JMX_MANAGER_START;
+import static org.apache.geode.distributed.ConfigurationProperties.LOG_FILE;
+import static 
org.apache.geode.internal.AvailablePortHelper.getRandomAvailableTCPPort;
+import static org.assertj.core.api.Assertions.assertThat;
+import static org.assertj.core.api.Assumptions.assumeThat;
+
+import java.io.File;
+import java.io.IOException;
+
+import org.junit.Before;
+import org.junit.Rule;
+import org.junit.Test;
+import org.junit.contrib.java.lang.system.RestoreSystemProperties;
+import org.junit.rules.TemporaryFolder;
+
+import org.apache.geode.distributed.ServerLauncher;
+import org.apache.geode.test.junit.rules.CloseableReference;
+
+public class ServerSetSystemPropertyGlobalSerialFilterIntegrationTest {

Review comment:
       Rename class to `ServerLauncherGlobalSerialFilterIntegrationTest`

##########
File path: 
geode-core/src/integrationTest/java/org/apache/geode/internal/io/ServerSetSystemPropertyGlobalSerialFilterIntegrationTest.java
##########
@@ -0,0 +1,160 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one or more 
contributor license
+ * agreements. See the NOTICE file distributed with this work for additional 
information regarding
+ * copyright ownership. The ASF licenses this file to You under the Apache 
License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance with the 
License. You may obtain a
+ * copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software 
distributed under the License
+ * is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY 
KIND, either express
+ * or implied. See the License for the specific language governing permissions 
and limitations under
+ * the License.
+ */
+package org.apache.geode.internal.io;
+
+import static org.apache.commons.lang3.JavaVersion.JAVA_1_8;
+import static org.apache.commons.lang3.JavaVersion.JAVA_9;
+import static org.apache.commons.lang3.SystemUtils.isJavaVersionAtLeast;
+import static org.apache.commons.lang3.SystemUtils.isJavaVersionAtMost;
+import static 
org.apache.geode.distributed.ConfigurationProperties.HTTP_SERVICE_PORT;
+import static org.apache.geode.distributed.ConfigurationProperties.JMX_MANAGER;
+import static 
org.apache.geode.distributed.ConfigurationProperties.JMX_MANAGER_PORT;
+import static 
org.apache.geode.distributed.ConfigurationProperties.JMX_MANAGER_START;
+import static org.apache.geode.distributed.ConfigurationProperties.LOG_FILE;
+import static 
org.apache.geode.internal.AvailablePortHelper.getRandomAvailableTCPPort;
+import static org.assertj.core.api.Assertions.assertThat;
+import static org.assertj.core.api.Assumptions.assumeThat;
+
+import java.io.File;
+import java.io.IOException;
+
+import org.junit.Before;
+import org.junit.Rule;
+import org.junit.Test;
+import org.junit.contrib.java.lang.system.RestoreSystemProperties;
+import org.junit.rules.TemporaryFolder;
+
+import org.apache.geode.distributed.ServerLauncher;
+import org.apache.geode.test.junit.rules.CloseableReference;
+
+public class ServerSetSystemPropertyGlobalSerialFilterIntegrationTest {
+
+  private static final String NAME = "server";
+  private static final String JDK_SERIAL_FILTER_PROPERTY = "jdk.serialFilter";
+
+  private File workingDirectory;
+  private int jmxPort;
+
+  @Rule
+  public CloseableReference<ServerLauncher> server = new 
CloseableReference<>();
+  @Rule
+  public RestoreSystemProperties restoreSystemProperties = new 
RestoreSystemProperties();
+  @Rule
+  public TemporaryFolder temporaryFolder = new TemporaryFolder();
+
+  @Before
+  public void setUp() throws IOException {
+    workingDirectory = temporaryFolder.newFolder(NAME);
+    jmxPort = getRandomAvailableTCPPort();
+  }
+
+  @Test
+  public void doesNotChangesEmptyJdkSerialFilter_onJava9orGreater() {
+    assumeThat(isJavaVersionAtLeast(JAVA_9)).isTrue();
+
+    System.setProperty(JDK_SERIAL_FILTER_PROPERTY, "");
+
+    server.set(new ServerLauncher.Builder()
+        .setMemberName(NAME)
+        .setDisableDefaultServer(true)
+        .setWorkingDirectory(workingDirectory.getAbsolutePath())
+        .set(HTTP_SERVICE_PORT, "0")
+        .set(JMX_MANAGER, "true")
+        .set(JMX_MANAGER_PORT, String.valueOf(jmxPort))
+        .set(JMX_MANAGER_START, "true")
+        .set(LOG_FILE, new File(workingDirectory, NAME + 
".log").getAbsolutePath())
+        .build())
+        .get()
+        .start();
+
+    assertThat(System.getProperty(JDK_SERIAL_FILTER_PROPERTY))
+        .as(JDK_SERIAL_FILTER_PROPERTY)
+        .isEmpty();
+  }
+
+  @Test
+  public void doesNotChangeNonEmptySerialFilter_onJava9orGreater() {
+    assumeThat(isJavaVersionAtLeast(JAVA_9)).isTrue();
+
+    String existingSerialFilter = "!*";
+    System.setProperty(JDK_SERIAL_FILTER_PROPERTY, existingSerialFilter);
+
+    server.set(new ServerLauncher.Builder()
+        .setMemberName(NAME)
+        .setDisableDefaultServer(true)
+        .setWorkingDirectory(workingDirectory.getAbsolutePath())
+        .set(HTTP_SERVICE_PORT, "0")
+        .set(JMX_MANAGER, "true")
+        .set(JMX_MANAGER_PORT, String.valueOf(jmxPort))
+        .set(JMX_MANAGER_START, "true")
+        .set(LOG_FILE, new File(workingDirectory, NAME + 
".log").getAbsolutePath())
+        .build())
+        .get()
+        .start();
+
+    assertThat(System.getProperty(JDK_SERIAL_FILTER_PROPERTY))
+        .as(JDK_SERIAL_FILTER_PROPERTY)
+        .isEqualTo(existingSerialFilter);
+  }
+
+  @Test
+  public void doesNotChangeEmptyJdkSerialFilter_onJava8() {

Review comment:
       Rename test to 
`doesNotConfigureGlobalSerialFilter_whenPropertyIsEmpty_onJava8`

##########
File path: 
geode-core/src/integrationTest/java/org/apache/geode/internal/io/ServerSerializableObjectFilterIntegrationTest.java
##########
@@ -0,0 +1,252 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one or more 
contributor license
+ * agreements. See the NOTICE file distributed with this work for additional 
information regarding
+ * copyright ownership. The ASF licenses this file to You under the Apache 
License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance with the 
License. You may obtain a
+ * copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software 
distributed under the License
+ * is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY 
KIND, either express
+ * or implied. See the License for the specific language governing permissions 
and limitations under
+ * the License.
+ */
+package org.apache.geode.internal.io;
+
+import static org.apache.commons.lang3.JavaVersion.JAVA_1_8;
+import static org.apache.commons.lang3.JavaVersion.JAVA_9;
+import static org.apache.commons.lang3.SystemUtils.isJavaVersionAtLeast;
+import static org.apache.commons.lang3.SystemUtils.isJavaVersionAtMost;
+import static 
org.apache.geode.distributed.ConfigurationProperties.HTTP_SERVICE_PORT;
+import static org.apache.geode.distributed.ConfigurationProperties.JMX_MANAGER;
+import static 
org.apache.geode.distributed.ConfigurationProperties.JMX_MANAGER_PORT;
+import static 
org.apache.geode.distributed.ConfigurationProperties.JMX_MANAGER_START;
+import static org.apache.geode.distributed.ConfigurationProperties.LOG_FILE;
+import static 
org.apache.geode.distributed.ConfigurationProperties.SERIALIZABLE_OBJECT_FILTER;
+import static 
org.apache.geode.distributed.ConfigurationProperties.VALIDATE_SERIALIZABLE_OBJECTS;
+import static 
org.apache.geode.internal.AvailablePortHelper.getRandomAvailableTCPPort;
+import static org.assertj.core.api.Assertions.assertThat;
+import static org.assertj.core.api.Assumptions.assumeThat;
+
+import java.io.File;
+import java.io.Serializable;
+
+import org.junit.Before;
+import org.junit.Rule;
+import org.junit.Test;
+import org.junit.contrib.java.lang.system.RestoreSystemProperties;
+import org.junit.rules.TemporaryFolder;
+
+import org.apache.geode.cache.Cache;
+import org.apache.geode.distributed.ServerLauncher;
+import org.apache.geode.distributed.internal.DistributionConfig;
+import org.apache.geode.internal.AvailablePortHelper;
+import org.apache.geode.internal.cache.InternalCache;
+import org.apache.geode.management.ManagementService;
+import org.apache.geode.management.internal.SystemManagementService;
+import org.apache.geode.test.junit.rules.CloseableReference;
+
+public class ServerSerializableObjectFilterIntegrationTest {
+
+  private static final String NAME = "server";
+
+  private File workingDirectory;
+  private int jmxPort;
+
+  @Rule
+  public CloseableReference<ServerLauncher> server = new 
CloseableReference<>();
+  @Rule
+  public RestoreSystemProperties restoreSystemProperties = new 
RestoreSystemProperties();
+  @Rule
+  public TemporaryFolder temporaryFolder = new TemporaryFolder();
+
+  @Before
+  public void setUp() throws Exception {
+    workingDirectory = temporaryFolder.newFolder(NAME);
+    jmxPort = getRandomAvailableTCPPort();
+  }
+
+  @Test
+  public void doesNotConfigureValidateSerializableObjects_onJava9orGreater() {
+    assumeThat(isJavaVersionAtLeast(JAVA_9)).isTrue();
+    int serverPort = AvailablePortHelper.getRandomAvailableTCPPort();
+    server.set(new ServerLauncher.Builder()
+        .setMemberName(NAME)
+        .setWorkingDirectory(workingDirectory.getAbsolutePath())
+        .setServerPort(serverPort)
+        .set(HTTP_SERVICE_PORT, "0")
+        .set(JMX_MANAGER, "true")
+        .set(JMX_MANAGER_PORT, String.valueOf(jmxPort))
+        .set(JMX_MANAGER_START, "true")
+        .set(LOG_FILE, new File(workingDirectory, NAME + 
".log").getAbsolutePath())
+        .build())
+        .get()
+        .start();
+
+    assertThat(isJmxManagerStarted())
+        .isTrue();
+    assertThat(isValidateSerializableObjectsConfigured())
+        .as(VALIDATE_SERIALIZABLE_OBJECTS)
+        .isFalse();
+  }
+
+  @Test
+  public void doesNotConfigureSerializableObjectFilter_onJava9OrGreater() {

Review comment:
       Rename test to 
`doesNotConfigureSerializableObjectFilter_onJava9orGreater` (lower case `or` to 
match other test names)

##########
File path: 
geode-core/src/test/java/org/apache/geode/distributed/LocatorLauncherTest.java
##########
@@ -30,7 +32,7 @@
 public class LocatorLauncherTest {
 
   @Test
-  public void canBeMocked() throws Exception {
+  public void canBeMocked() {

Review comment:
       I think you should revert the changes to this file. Nothing here is 
pertinent to the PR.

##########
File path: 
geode-serialization/src/main/java/org/apache/geode/internal/serialization/filter/SerializableObjectConfig.java
##########
@@ -0,0 +1,28 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one or more 
contributor license
+ * agreements. See the NOTICE file distributed with this work for additional 
information regarding
+ * copyright ownership. The ASF licenses this file to You under the Apache 
License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance with the 
License. You may obtain a
+ * copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software 
distributed under the License
+ * is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY 
KIND, either express
+ * or implied. See the License for the specific language governing permissions 
and limitations under
+ * the License.
+ */
+package org.apache.geode.internal.serialization.filter;
+
+public interface SerializableObjectConfig {
+
+  default String getFilterPatternIfEnabled() {
+    return getValidateSerializableObjects() ? getSerializableObjectFilter() : 
null;
+  }
+
+  boolean getValidateSerializableObjects(); // validate-serializable-objects 
-- boolean
+
+  void setValidateSerializableObjects(boolean value); // set 
validate-serializable-objects
+
+  String getSerializableObjectFilter(); // serializable-object-filter -- string

Review comment:
       Delete the comments from the end of the lines

##########
File path: 
geode-core/src/integrationTest/java/org/apache/geode/internal/io/ServerSetSystemPropertyGlobalSerialFilterIntegrationTest.java
##########
@@ -0,0 +1,160 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one or more 
contributor license
+ * agreements. See the NOTICE file distributed with this work for additional 
information regarding
+ * copyright ownership. The ASF licenses this file to You under the Apache 
License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance with the 
License. You may obtain a
+ * copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software 
distributed under the License
+ * is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY 
KIND, either express
+ * or implied. See the License for the specific language governing permissions 
and limitations under
+ * the License.
+ */
+package org.apache.geode.internal.io;
+
+import static org.apache.commons.lang3.JavaVersion.JAVA_1_8;
+import static org.apache.commons.lang3.JavaVersion.JAVA_9;
+import static org.apache.commons.lang3.SystemUtils.isJavaVersionAtLeast;
+import static org.apache.commons.lang3.SystemUtils.isJavaVersionAtMost;
+import static 
org.apache.geode.distributed.ConfigurationProperties.HTTP_SERVICE_PORT;
+import static org.apache.geode.distributed.ConfigurationProperties.JMX_MANAGER;
+import static 
org.apache.geode.distributed.ConfigurationProperties.JMX_MANAGER_PORT;
+import static 
org.apache.geode.distributed.ConfigurationProperties.JMX_MANAGER_START;
+import static org.apache.geode.distributed.ConfigurationProperties.LOG_FILE;
+import static 
org.apache.geode.internal.AvailablePortHelper.getRandomAvailableTCPPort;
+import static org.assertj.core.api.Assertions.assertThat;
+import static org.assertj.core.api.Assumptions.assumeThat;
+
+import java.io.File;
+import java.io.IOException;
+
+import org.junit.Before;
+import org.junit.Rule;
+import org.junit.Test;
+import org.junit.contrib.java.lang.system.RestoreSystemProperties;
+import org.junit.rules.TemporaryFolder;
+
+import org.apache.geode.distributed.ServerLauncher;
+import org.apache.geode.test.junit.rules.CloseableReference;
+
+public class ServerSetSystemPropertyGlobalSerialFilterIntegrationTest {
+
+  private static final String NAME = "server";
+  private static final String JDK_SERIAL_FILTER_PROPERTY = "jdk.serialFilter";
+
+  private File workingDirectory;
+  private int jmxPort;
+
+  @Rule
+  public CloseableReference<ServerLauncher> server = new 
CloseableReference<>();
+  @Rule
+  public RestoreSystemProperties restoreSystemProperties = new 
RestoreSystemProperties();
+  @Rule
+  public TemporaryFolder temporaryFolder = new TemporaryFolder();
+
+  @Before
+  public void setUp() throws IOException {
+    workingDirectory = temporaryFolder.newFolder(NAME);
+    jmxPort = getRandomAvailableTCPPort();
+  }
+
+  @Test
+  public void doesNotChangesEmptyJdkSerialFilter_onJava9orGreater() {
+    assumeThat(isJavaVersionAtLeast(JAVA_9)).isTrue();
+
+    System.setProperty(JDK_SERIAL_FILTER_PROPERTY, "");
+
+    server.set(new ServerLauncher.Builder()
+        .setMemberName(NAME)
+        .setDisableDefaultServer(true)
+        .setWorkingDirectory(workingDirectory.getAbsolutePath())
+        .set(HTTP_SERVICE_PORT, "0")
+        .set(JMX_MANAGER, "true")
+        .set(JMX_MANAGER_PORT, String.valueOf(jmxPort))
+        .set(JMX_MANAGER_START, "true")
+        .set(LOG_FILE, new File(workingDirectory, NAME + 
".log").getAbsolutePath())
+        .build())
+        .get()
+        .start();
+
+    assertThat(System.getProperty(JDK_SERIAL_FILTER_PROPERTY))
+        .as(JDK_SERIAL_FILTER_PROPERTY)
+        .isEmpty();
+  }
+
+  @Test
+  public void doesNotChangeNonEmptySerialFilter_onJava9orGreater() {

Review comment:
       Rename test to 
`doesNotConfigureGlobalSerialFilter_whenPropertyIsNotEmpty_onJava9orGreater`

##########
File path: 
geode-core/src/integrationTest/java/org/apache/geode/internal/io/ServerSerializableObjectFilterIntegrationTest.java
##########
@@ -0,0 +1,252 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one or more 
contributor license
+ * agreements. See the NOTICE file distributed with this work for additional 
information regarding
+ * copyright ownership. The ASF licenses this file to You under the Apache 
License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance with the 
License. You may obtain a
+ * copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software 
distributed under the License
+ * is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY 
KIND, either express
+ * or implied. See the License for the specific language governing permissions 
and limitations under
+ * the License.
+ */
+package org.apache.geode.internal.io;
+
+import static org.apache.commons.lang3.JavaVersion.JAVA_1_8;
+import static org.apache.commons.lang3.JavaVersion.JAVA_9;
+import static org.apache.commons.lang3.SystemUtils.isJavaVersionAtLeast;
+import static org.apache.commons.lang3.SystemUtils.isJavaVersionAtMost;
+import static 
org.apache.geode.distributed.ConfigurationProperties.HTTP_SERVICE_PORT;
+import static org.apache.geode.distributed.ConfigurationProperties.JMX_MANAGER;
+import static 
org.apache.geode.distributed.ConfigurationProperties.JMX_MANAGER_PORT;
+import static 
org.apache.geode.distributed.ConfigurationProperties.JMX_MANAGER_START;
+import static org.apache.geode.distributed.ConfigurationProperties.LOG_FILE;
+import static 
org.apache.geode.distributed.ConfigurationProperties.SERIALIZABLE_OBJECT_FILTER;
+import static 
org.apache.geode.distributed.ConfigurationProperties.VALIDATE_SERIALIZABLE_OBJECTS;
+import static 
org.apache.geode.internal.AvailablePortHelper.getRandomAvailableTCPPort;
+import static org.assertj.core.api.Assertions.assertThat;
+import static org.assertj.core.api.Assumptions.assumeThat;
+
+import java.io.File;
+import java.io.Serializable;
+
+import org.junit.Before;
+import org.junit.Rule;
+import org.junit.Test;
+import org.junit.contrib.java.lang.system.RestoreSystemProperties;
+import org.junit.rules.TemporaryFolder;
+
+import org.apache.geode.cache.Cache;
+import org.apache.geode.distributed.ServerLauncher;
+import org.apache.geode.distributed.internal.DistributionConfig;
+import org.apache.geode.internal.AvailablePortHelper;
+import org.apache.geode.internal.cache.InternalCache;
+import org.apache.geode.management.ManagementService;
+import org.apache.geode.management.internal.SystemManagementService;
+import org.apache.geode.test.junit.rules.CloseableReference;
+
+public class ServerSerializableObjectFilterIntegrationTest {
+
+  private static final String NAME = "server";
+
+  private File workingDirectory;
+  private int jmxPort;
+
+  @Rule
+  public CloseableReference<ServerLauncher> server = new 
CloseableReference<>();
+  @Rule
+  public RestoreSystemProperties restoreSystemProperties = new 
RestoreSystemProperties();
+  @Rule
+  public TemporaryFolder temporaryFolder = new TemporaryFolder();
+
+  @Before
+  public void setUp() throws Exception {
+    workingDirectory = temporaryFolder.newFolder(NAME);
+    jmxPort = getRandomAvailableTCPPort();
+  }
+
+  @Test
+  public void doesNotConfigureValidateSerializableObjects_onJava9orGreater() {
+    assumeThat(isJavaVersionAtLeast(JAVA_9)).isTrue();
+    int serverPort = AvailablePortHelper.getRandomAvailableTCPPort();
+    server.set(new ServerLauncher.Builder()
+        .setMemberName(NAME)
+        .setWorkingDirectory(workingDirectory.getAbsolutePath())
+        .setServerPort(serverPort)
+        .set(HTTP_SERVICE_PORT, "0")
+        .set(JMX_MANAGER, "true")
+        .set(JMX_MANAGER_PORT, String.valueOf(jmxPort))
+        .set(JMX_MANAGER_START, "true")
+        .set(LOG_FILE, new File(workingDirectory, NAME + 
".log").getAbsolutePath())
+        .build())
+        .get()
+        .start();
+
+    assertThat(isJmxManagerStarted())
+        .isTrue();
+    assertThat(isValidateSerializableObjectsConfigured())
+        .as(VALIDATE_SERIALIZABLE_OBJECTS)
+        .isFalse();
+  }
+
+  @Test
+  public void doesNotConfigureSerializableObjectFilter_onJava9OrGreater() {
+    assumeThat(isJavaVersionAtLeast(JAVA_9)).isTrue();
+    int serverPort = AvailablePortHelper.getRandomAvailableTCPPort();
+    server.set(new ServerLauncher.Builder()
+        .setMemberName(NAME)
+        .setWorkingDirectory(workingDirectory.getAbsolutePath())
+        .setServerPort(serverPort)
+        .set(HTTP_SERVICE_PORT, "0")
+        .set(JMX_MANAGER, "true")
+        .set(JMX_MANAGER_PORT, String.valueOf(jmxPort))
+        .set(JMX_MANAGER_START, "true")
+        .set(LOG_FILE, new File(workingDirectory, NAME + 
".log").getAbsolutePath())
+        .build())
+        .get()
+        .start();
+
+    assertThat(isJmxManagerStarted())
+        .isTrue();
+    assertThat(getSerializableObjectFilter())
+        .as(SERIALIZABLE_OBJECT_FILTER)
+        .isEqualTo("!*");
+  }
+
+  @Test
+  public void doesNotConfigureValidateSerializableObjects_onJava8() {
+    assumeThat(isJavaVersionAtLeast(JAVA_9)).isTrue();
+    int serverPort = AvailablePortHelper.getRandomAvailableTCPPort();
+    server.set(new ServerLauncher.Builder()
+        .setMemberName(NAME)
+        .setWorkingDirectory(workingDirectory.getAbsolutePath())
+        .setServerPort(serverPort)
+        .set(HTTP_SERVICE_PORT, "0")
+        .set(JMX_MANAGER, "true")
+        .set(JMX_MANAGER_PORT, String.valueOf(jmxPort))
+        .set(JMX_MANAGER_START, "true")
+        .set(LOG_FILE, new File(workingDirectory, NAME + 
".log").getAbsolutePath())
+        .build())
+        .get()
+        .start();
+
+    assertThat(isJmxManagerStarted())
+        .isTrue();
+    assertThat(isValidateSerializableObjectsConfigured())
+        .as(VALIDATE_SERIALIZABLE_OBJECTS)
+        .isFalse();
+  }
+
+  @Test
+  public void doesNotConfigureSerializableObjectFilter_onJava8() {
+    assumeThat(isJavaVersionAtMost(JAVA_1_8)).isTrue();
+    int serverPort = AvailablePortHelper.getRandomAvailableTCPPort();
+    server.set(new ServerLauncher.Builder()
+        .setMemberName(NAME)
+        .setWorkingDirectory(workingDirectory.getAbsolutePath())
+        .setServerPort(serverPort)
+        .set(HTTP_SERVICE_PORT, "0")
+        .set(JMX_MANAGER, "true")
+        .set(JMX_MANAGER_PORT, String.valueOf(jmxPort))
+        .set(JMX_MANAGER_START, "true")
+        .set(LOG_FILE, new File(workingDirectory, NAME + 
".log").getAbsolutePath())
+        .build())
+        .get()
+        .start();
+
+    assertThat(isJmxManagerStarted())
+        .isTrue();
+    assertThat(getSerializableObjectFilter())
+        .as(SERIALIZABLE_OBJECT_FILTER)
+        .isEqualTo("!*");
+  }
+
+  @Test
+  public void userSpecifiedSerializableObjectFilter_onJava8() {
+    assumeThat(isJavaVersionAtMost(JAVA_1_8)).isTrue();
+    String existingSerializableObjectFilter = "!foo.Bar;*";
+    int serverPort = AvailablePortHelper.getRandomAvailableTCPPort();
+    server.set(new ServerLauncher.Builder()
+        .setMemberName(NAME)
+        .setWorkingDirectory(workingDirectory.getAbsolutePath())
+        .setServerPort(serverPort)
+        .set(HTTP_SERVICE_PORT, "0")
+        .set(JMX_MANAGER, "true")
+        .set(JMX_MANAGER_PORT, String.valueOf(jmxPort))
+        .set(JMX_MANAGER_START, "true")
+        .set(SERIALIZABLE_OBJECT_FILTER, existingSerializableObjectFilter)
+        .set(LOG_FILE, new File(workingDirectory, NAME + 
".log").getAbsolutePath())
+        .build())
+        .get()
+        .start();
+
+    assertThat(isJmxManagerStarted())
+        .isTrue();
+    assertThat(getSerializableObjectFilter())
+        .as(SERIALIZABLE_OBJECT_FILTER)
+        .isEqualTo(existingSerializableObjectFilter);
+  }
+
+  @Test
+  public void userSpecifiedSerializableObjectFilter_onJava9OrGreater() {

Review comment:
       Delete test. Same as previous test.

##########
File path: 
geode-core/src/test/java/org/apache/geode/distributed/internal/ServerLocationTest.java
##########
@@ -0,0 +1,41 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one or more 
contributor license
+ * agreements. See the NOTICE file distributed with this work for additional 
information regarding
+ * copyright ownership. The ASF licenses this file to You under the Apache 
License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance with the 
License. You may obtain a
+ * copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software 
distributed under the License
+ * is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY 
KIND, either express
+ * or implied. See the License for the specific language governing permissions 
and limitations under
+ * the License.
+ */
+package org.apache.geode.distributed.internal;
+
+import static org.assertj.core.api.Assertions.assertThat;
+
+import org.junit.Test;
+import org.junit.experimental.categories.Category;
+
+import org.apache.geode.test.junit.categories.MembershipTest;
+
+@Category(MembershipTest.class)
+public class ServerLocationTest {

Review comment:
       What is this test doing in this PR? I think it may have come from a 
merge. We should probably revert this and delete it from the PR.

##########
File path: 
geode-core/src/main/java/org/apache/geode/internal/InternalDataSerializer.java
##########
@@ -447,6 +378,11 @@ static void clearSerializationFilter() {
     serializationFilter = defaultSerializationFilter;
   }
 
+  @VisibleForTesting
+  public static ObjectInputFilter getSerializationFilter() {

Review comment:
       Can this be non-public or does a test outside this package need to call 
it?

##########
File path: 
geode-serialization/src/test/java/org/apache/geode/internal/serialization/filter/ReflectionObjectInputFilterApiTest.java
##########
@@ -0,0 +1,231 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one or more 
contributor license
+ * agreements. See the NOTICE file distributed with this work for additional 
information regarding
+ * copyright ownership. The ASF licenses this file to You under the Apache 
License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance with the 
License. You may obtain a
+ * copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software 
distributed under the License
+ * is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY 
KIND, either express
+ * or implied. See the License for the specific language governing permissions 
and limitations under
+ * the License.
+ */
+package org.apache.geode.internal.serialization.filter;
+
+import static java.util.Collections.emptyList;
+import static java.util.Collections.singleton;
+import static java.util.Objects.hash;
+import static java.util.Objects.requireNonNull;
+import static org.apache.commons.lang3.JavaVersion.JAVA_1_8;
+import static org.apache.commons.lang3.JavaVersion.JAVA_9;
+import static org.apache.commons.lang3.SerializationUtils.serialize;
+import static org.apache.commons.lang3.SystemUtils.isJavaVersionAtLeast;
+import static org.assertj.core.api.Assertions.assertThat;
+import static org.assertj.core.api.Assertions.catchThrowable;
+
+import java.io.ByteArrayInputStream;
+import java.io.IOException;
+import java.io.InvalidClassException;
+import java.io.ObjectInputStream;
+import java.io.Serializable;
+import java.lang.reflect.InvocationTargetException;
+
+import org.junit.Before;
+import org.junit.Test;
+
+public class ReflectionObjectInputFilterApiTest {
+
+  private ObjectInputFilterApi api;
+
+  @Before
+  public void setUp() throws ClassNotFoundException, NoSuchMethodException {
+    if (isJavaVersionAtLeast(JAVA_9)) {
+      api = new Java9ReflectionObjectInputFilterApi(ApiPackage.JAVA_IO);
+    } else if (isJavaVersionAtLeast(JAVA_1_8)) {
+      api = new ReflectionObjectInputFilterApi(ApiPackage.SUN_MISC);
+    }
+  }
+
+  // @Test
+  // public void constructsWithoutThrowing() {
+  // assertThatCode(() -> new
+  // ReflectionObjectInputFilterApi(apiPackage)).doesNotThrowAnyException();
+  // }

Review comment:
       Delete

##########
File path: 
geode-core/src/integrationTest/java/org/apache/geode/internal/io/ServerSetSystemPropertyGlobalSerialFilterIntegrationTest.java
##########
@@ -0,0 +1,160 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one or more 
contributor license
+ * agreements. See the NOTICE file distributed with this work for additional 
information regarding
+ * copyright ownership. The ASF licenses this file to You under the Apache 
License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance with the 
License. You may obtain a
+ * copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software 
distributed under the License
+ * is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY 
KIND, either express
+ * or implied. See the License for the specific language governing permissions 
and limitations under
+ * the License.
+ */
+package org.apache.geode.internal.io;
+
+import static org.apache.commons.lang3.JavaVersion.JAVA_1_8;
+import static org.apache.commons.lang3.JavaVersion.JAVA_9;
+import static org.apache.commons.lang3.SystemUtils.isJavaVersionAtLeast;
+import static org.apache.commons.lang3.SystemUtils.isJavaVersionAtMost;
+import static 
org.apache.geode.distributed.ConfigurationProperties.HTTP_SERVICE_PORT;
+import static org.apache.geode.distributed.ConfigurationProperties.JMX_MANAGER;
+import static 
org.apache.geode.distributed.ConfigurationProperties.JMX_MANAGER_PORT;
+import static 
org.apache.geode.distributed.ConfigurationProperties.JMX_MANAGER_START;
+import static org.apache.geode.distributed.ConfigurationProperties.LOG_FILE;
+import static 
org.apache.geode.internal.AvailablePortHelper.getRandomAvailableTCPPort;
+import static org.assertj.core.api.Assertions.assertThat;
+import static org.assertj.core.api.Assumptions.assumeThat;
+
+import java.io.File;
+import java.io.IOException;
+
+import org.junit.Before;
+import org.junit.Rule;
+import org.junit.Test;
+import org.junit.contrib.java.lang.system.RestoreSystemProperties;
+import org.junit.rules.TemporaryFolder;
+
+import org.apache.geode.distributed.ServerLauncher;
+import org.apache.geode.test.junit.rules.CloseableReference;
+
+public class ServerSetSystemPropertyGlobalSerialFilterIntegrationTest {
+
+  private static final String NAME = "server";
+  private static final String JDK_SERIAL_FILTER_PROPERTY = "jdk.serialFilter";
+
+  private File workingDirectory;
+  private int jmxPort;
+
+  @Rule
+  public CloseableReference<ServerLauncher> server = new 
CloseableReference<>();
+  @Rule
+  public RestoreSystemProperties restoreSystemProperties = new 
RestoreSystemProperties();
+  @Rule
+  public TemporaryFolder temporaryFolder = new TemporaryFolder();
+
+  @Before
+  public void setUp() throws IOException {
+    workingDirectory = temporaryFolder.newFolder(NAME);
+    jmxPort = getRandomAvailableTCPPort();
+  }
+
+  @Test
+  public void doesNotChangesEmptyJdkSerialFilter_onJava9orGreater() {
+    assumeThat(isJavaVersionAtLeast(JAVA_9)).isTrue();
+
+    System.setProperty(JDK_SERIAL_FILTER_PROPERTY, "");
+
+    server.set(new ServerLauncher.Builder()
+        .setMemberName(NAME)
+        .setDisableDefaultServer(true)
+        .setWorkingDirectory(workingDirectory.getAbsolutePath())
+        .set(HTTP_SERVICE_PORT, "0")
+        .set(JMX_MANAGER, "true")
+        .set(JMX_MANAGER_PORT, String.valueOf(jmxPort))
+        .set(JMX_MANAGER_START, "true")
+        .set(LOG_FILE, new File(workingDirectory, NAME + 
".log").getAbsolutePath())
+        .build())
+        .get()
+        .start();
+
+    assertThat(System.getProperty(JDK_SERIAL_FILTER_PROPERTY))
+        .as(JDK_SERIAL_FILTER_PROPERTY)
+        .isEmpty();
+  }
+
+  @Test
+  public void doesNotChangeNonEmptySerialFilter_onJava9orGreater() {
+    assumeThat(isJavaVersionAtLeast(JAVA_9)).isTrue();
+
+    String existingSerialFilter = "!*";
+    System.setProperty(JDK_SERIAL_FILTER_PROPERTY, existingSerialFilter);
+
+    server.set(new ServerLauncher.Builder()
+        .setMemberName(NAME)
+        .setDisableDefaultServer(true)
+        .setWorkingDirectory(workingDirectory.getAbsolutePath())
+        .set(HTTP_SERVICE_PORT, "0")
+        .set(JMX_MANAGER, "true")
+        .set(JMX_MANAGER_PORT, String.valueOf(jmxPort))
+        .set(JMX_MANAGER_START, "true")
+        .set(LOG_FILE, new File(workingDirectory, NAME + 
".log").getAbsolutePath())
+        .build())
+        .get()
+        .start();
+
+    assertThat(System.getProperty(JDK_SERIAL_FILTER_PROPERTY))
+        .as(JDK_SERIAL_FILTER_PROPERTY)
+        .isEqualTo(existingSerialFilter);
+  }
+
+  @Test
+  public void doesNotChangeEmptyJdkSerialFilter_onJava8() {
+    assumeThat(isJavaVersionAtMost(JAVA_1_8)).isTrue();
+
+    System.setProperty(JDK_SERIAL_FILTER_PROPERTY, "");
+
+    server.set(new ServerLauncher.Builder()
+        .setMemberName(NAME)
+        .setDisableDefaultServer(true)
+        .setWorkingDirectory(workingDirectory.getAbsolutePath())
+        .set(HTTP_SERVICE_PORT, "0")
+        .set(JMX_MANAGER, "true")
+        .set(JMX_MANAGER_PORT, String.valueOf(jmxPort))
+        .set(JMX_MANAGER_START, "true")
+        .set(LOG_FILE, new File(workingDirectory, NAME + 
".log").getAbsolutePath())
+        .build())
+        .get()
+        .start();
+
+    assertThat(System.getProperty(JDK_SERIAL_FILTER_PROPERTY))
+        .as(JDK_SERIAL_FILTER_PROPERTY)
+        .isEqualTo("");
+  }
+
+  @Test
+  public void doesNotChangeNonEmptyJdkSerialFilter_onJava8() {

Review comment:
       Rename test to 
`doesNotConfigureGlobalSerialFilter_whenPropertyIsNotEmpty_onJava8`

##########
File path: 
geode-core/src/integrationTest/java/org/apache/geode/internal/io/LocatorGlobalSerialFilterPropertyExistsIntegrationTest.java
##########
@@ -0,0 +1,117 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one or more 
contributor license
+ * agreements. See the NOTICE file distributed with this work for additional 
information regarding
+ * copyright ownership. The ASF licenses this file to You under the Apache 
License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance with the 
License. You may obtain a
+ * copy of the License at
+ *
+ * http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software 
distributed under the License
+ * is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY 
KIND, either express
+ * or implied. See the License for the specific language governing permissions 
and limitations under
+ * the License.
+ */
+package org.apache.geode.internal.io;
+
+import static org.apache.commons.lang3.JavaVersion.JAVA_1_8;
+import static org.apache.commons.lang3.JavaVersion.JAVA_9;
+import static org.apache.commons.lang3.SystemUtils.isJavaVersionAtLeast;
+import static org.apache.commons.lang3.SystemUtils.isJavaVersionAtMost;
+import static 
org.apache.geode.distributed.ConfigurationProperties.HTTP_SERVICE_PORT;
+import static org.apache.geode.distributed.ConfigurationProperties.JMX_MANAGER;
+import static 
org.apache.geode.distributed.ConfigurationProperties.JMX_MANAGER_PORT;
+import static 
org.apache.geode.distributed.ConfigurationProperties.JMX_MANAGER_START;
+import static org.apache.geode.distributed.ConfigurationProperties.LOG_FILE;
+import static 
org.apache.geode.internal.AvailablePortHelper.getRandomAvailableTCPPorts;
+import static org.assertj.core.api.Assertions.assertThat;
+import static org.assertj.core.api.Assumptions.assumeThat;
+
+import java.io.File;
+import java.io.IOException;
+import java.lang.reflect.InvocationTargetException;
+
+import org.junit.Before;
+import org.junit.Rule;
+import org.junit.Test;
+import org.junit.contrib.java.lang.system.RestoreSystemProperties;
+import org.junit.rules.TemporaryFolder;
+
+import org.apache.geode.distributed.LocatorLauncher;
+import org.apache.geode.internal.serialization.filter.ObjectInputFilterApi;
+import 
org.apache.geode.internal.serialization.filter.ReflectionObjectInputFilterApiFactory;
+import org.apache.geode.test.junit.rules.CloseableReference;
+
+public class LocatorGlobalSerialFilterPropertyExistsIntegrationTest {
+
+  private static final String NAME = "locator";
+  private static final String JDK_SERIAL_FILTER_PROPERTY = "jdk.serialFilter";
+  private static final ObjectInputFilterApi OBJECT_INPUT_FILTER_API =
+      new ReflectionObjectInputFilterApiFactory().createObjectInputFilterApi();
+
+  private File workingDirectory;
+  private int locatorPort;
+  private int jmxPort;
+
+  @Rule
+  public CloseableReference<LocatorLauncher> locator = new 
CloseableReference<>();
+  @Rule
+  public RestoreSystemProperties restoreSystemProperties = new 
RestoreSystemProperties();
+  @Rule
+  public TemporaryFolder temporaryFolder = new TemporaryFolder();
+
+  @Before
+  public void setUp() throws IOException {
+    workingDirectory = temporaryFolder.newFolder(NAME);
+    int[] ports = getRandomAvailableTCPPorts(2);
+    jmxPort = ports[0];
+    locatorPort = ports[1];
+  }
+
+  @Test
+  public void setsSerialFilterWhenJdkSerialFilterPropertyIsSetToBlank_onJava8()
+      throws InvocationTargetException, IllegalAccessException {
+    assumeThat(isJavaVersionAtMost(JAVA_1_8)).isTrue();
+
+    System.setProperty(JDK_SERIAL_FILTER_PROPERTY, " ");
+
+    locator.set(new LocatorLauncher.Builder()
+        .setMemberName(NAME)
+        .setPort(locatorPort)
+        .setWorkingDirectory(workingDirectory.getAbsolutePath())
+        .set(HTTP_SERVICE_PORT, "0")
+        .set(JMX_MANAGER_PORT, String.valueOf(jmxPort))
+        .set(JMX_MANAGER_START, "true")
+        .set(LOG_FILE, new File(workingDirectory, NAME + 
".log").getAbsolutePath())
+        .build())
+        .get()
+        .start();
+
+    assertThat(OBJECT_INPUT_FILTER_API.getSerialFilter())
+        .as("ObjectInputFilter$Config.getSerialFilter()")
+        .isNotNull();

Review comment:
       Add a TODO comment here and we'll investigate further

##########
File path: 
geode-core/src/main/java/org/apache/geode/distributed/LocatorLauncher.java
##########
@@ -709,11 +722,31 @@ private boolean isStartable() {
    * @see org.apache.geode.distributed.AbstractLauncher.Status#ONLINE
    * @see org.apache.geode.distributed.AbstractLauncher.Status#STARTING
    */
-  @SuppressWarnings("deprecation")
   public LocatorState start() {
     if (isStartable()) {
       INSTANCE.compareAndSet(null, this);
 
+      boolean serializationFilterConfigured = false;
+      if (isJavaVersionAtLeast(JAVA_1_8) && isJavaVersionAtMost(JAVA_1_8)) {

Review comment:
       We might delete the new `isJavaVersion` and just always use the apache 
commons methods.




-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: notifications-unsubscr...@geode.apache.org

For queries about this service, please contact Infrastructure at:
us...@infra.apache.org