ObjectStreamClassPredicate.java
/*
* Licensed to the Apache Software Foundation (ASF) under one
* or more contributor license agreements. See the NOTICE file
* distributed with this work for additional information
* regarding copyright ownership. The ASF licenses this file
* to you under the Apache License, Version 2.0 (the
* "License"); you may not use this file except in compliance
* with the License. You may obtain a copy of the License at
*
* https://www.apache.org/licenses/LICENSE-2.0
*
* Unless required by applicable law or agreed to in writing,
* software distributed under the License is distributed on an
* "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
* KIND, either express or implied. See the License for the
* specific language governing permissions and limitations
* under the License.
*/
package org.apache.commons.io.serialization;
import java.io.ObjectStreamClass;
import java.util.ArrayList;
import java.util.List;
import java.util.function.Predicate;
import java.util.regex.Pattern;
import java.util.stream.Stream;
/**
* A predicate (boolean-valued function) of one argument to accept and reject classes.
* <p>
* The reject list takes precedence over the accept list.
* </p>
*
* @since 2.18.0
*/
public class ObjectStreamClassPredicate implements Predicate<ObjectStreamClass> {
/**
* This is not a Set for now to avoid ClassNameMatchers requiring proper implementations of hashCode() and equals().
*/
private final List<ClassNameMatcher> acceptMatchers = new ArrayList<>();
/**
* This is not a Set for now to avoid ClassNameMatchers requiring proper implementations of hashCode() and equals().
*/
private final List<ClassNameMatcher> rejectMatchers = new ArrayList<>();
/**
* Constructs a new instance.
*/
public ObjectStreamClassPredicate() {
// empty
}
/**
* Accepts the specified classes for deserialization, unless they are otherwise rejected.
* <p>
* The reject list takes precedence over the accept list.
* </p>
*
* <p>
* Classes are matched by their exact names. Array classes must be accepted separately from their element classes.
* For example, accepting {@code Foo.class} does not accept {@code Foo[].class}.
* </p>
*
* @param classes Classes to accept.
* @return this object.
*/
public ObjectStreamClassPredicate accept(final Class<?>... classes) {
Stream.of(classes).map(c -> new FullClassNameMatcher(c.getName())).forEach(acceptMatchers::add);
return this;
}
/**
* Accepts class names where the supplied ClassNameMatcher matches for deserialization, unless they are otherwise rejected.
* <p>
* The reject list takes precedence over the accept list.
* </p>
*
* @param matcher A class name matcher to <em>accept</em> objects.
* @return {@code this} instance.
*/
public ObjectStreamClassPredicate accept(final ClassNameMatcher matcher) {
acceptMatchers.add(matcher);
return this;
}
/**
* Accepts class names that match the supplied pattern for deserialization, unless they are otherwise rejected.
* <p>
* The reject list takes precedence over the accept list.
* </p>
*
* <p>
* The pattern must match the entire class name, as defined by {@link java.util.regex.Matcher#matches()}.
* For example, {@code foo\.Bar} matches {@code foo.Bar}, but not {@code foo.BarExtra}. Use {@code .*foo\.Bar.*} to match a substring.
* </p>
*
* @param pattern A Pattern for compiled regular expression.
* @return {@code this} instance.
*/
public ObjectStreamClassPredicate accept(final Pattern pattern) {
acceptMatchers.add(new RegexpClassNameMatcher(pattern));
return this;
}
/**
* Accepts the wildcard specified classes for deserialization, unless they are otherwise rejected.
* <p>
* The reject list takes precedence over the accept list.
* </p>
*
* <p>
* Matching is case-sensitive. The wildcard {@code *} matches zero or more characters and {@code ?} matches one character, including {@code '.'} in both
* cases. Unlike <a href="https://openjdk.org/jeps/290">JEP 290</a> serialization filter patterns, these patterns do not treat package boundaries specially:
* {@code com.example.*} matches classes in {@code com.example} and all its subpackages, and {@code **} is equivalent to {@code *}.
* </p>
*
* <p>
* Use {@link #accept(Pattern)} with a regular expression to match only classes directly in a package.
* </p>
*
* @param patterns Wildcard file name patterns as defined by {@link org.apache.commons.io.FilenameUtils#wildcardMatch(String, String)
* FilenameUtils.wildcardMatch}
* @return {@code this} instance.
*/
public ObjectStreamClassPredicate accept(final String... patterns) {
Stream.of(patterns).map(WildcardClassNameMatcher::new).forEach(acceptMatchers::add);
return this;
}
/**
* Rejects the specified classes for deserialization, even if they are otherwise accepted.
* <p>
* The reject list takes precedence over the accept list.
* </p>
*
* <p>
* Classes are matched by their exact names. Rejecting {@code Foo.class} does not reject {@code Foo[].class}, so an otherwise accepted
* empty or null-only array can still be deserialized. Element class descriptors encountered while reading array contents are checked separately.
* To reject the array class itself, also reject {@code Foo[].class}.
* </p>
*
* @param classes Classes to reject.
* @return {@code this} instance.
*/
public ObjectStreamClassPredicate reject(final Class<?>... classes) {
Stream.of(classes).map(c -> new FullClassNameMatcher(c.getName())).forEach(rejectMatchers::add);
return this;
}
/**
* Rejects class names where the supplied ClassNameMatcher matches for deserialization, even if they are otherwise accepted.
* <p>
* The reject list takes precedence over the accept list.
* </p>
*
* @param m The matcher to use.
* @return {@code this} instance.
*/
public ObjectStreamClassPredicate reject(final ClassNameMatcher m) {
rejectMatchers.add(m);
return this;
}
/**
* Rejects class names that match the supplied pattern for deserialization, even if they are otherwise accepted.
* <p>
* The reject list takes precedence over the accept list.
* </p>
*
* <p>
* The pattern must match the entire class name, as defined by {@link java.util.regex.Matcher#matches()}.
* For example, {@code foo\.Bar} matches {@code foo.Bar}, but not {@code foo.BarExtra}. Use {@code .*foo\.Bar.*} to match a substring.
* </p>
*
* @param pattern standard Java regexp.
* @return {@code this} instance.
*/
public ObjectStreamClassPredicate reject(final Pattern pattern) {
rejectMatchers.add(new RegexpClassNameMatcher(pattern));
return this;
}
/**
* Rejects the wildcard specified classes for deserialization, even if they are otherwise accepted.
* <p>
* The reject list takes precedence over the accept list.
* </p>
*
* <p>
* Matching is case-sensitive. The wildcard {@code *} matches zero or more characters and {@code ?} matches one character, including {@code '.'} in both
* cases. Unlike <a href="https://openjdk.org/jeps/290">JEP 290</a> serialization filter patterns, these patterns do not treat package boundaries specially:
* {@code com.example.*} matches classes in {@code com.example} and all its subpackages, and {@code **} is equivalent to {@code *}.
* </p>
*
* <p>
* Use {@link #reject(Pattern)} with a regular expression to match only classes directly in a package.
* </p>
*
* @param patterns Wildcard file name patterns as defined by {@link org.apache.commons.io.FilenameUtils#wildcardMatch(String, String)
* FilenameUtils.wildcardMatch}
* @return {@code this} instance.
*/
public ObjectStreamClassPredicate reject(final String... patterns) {
Stream.of(patterns).map(WildcardClassNameMatcher::new).forEach(rejectMatchers::add);
return this;
}
/**
* Tests that the ObjectStreamClass conforms to requirements.
* <p>
* The reject list takes precedence over the accept list.
* </p>
*
* @param objectStreamClass The ObjectStreamClass to test.
* @return true if the input is accepted, false if rejected, false if neither.
*/
@Override
public boolean test(final ObjectStreamClass objectStreamClass) {
return test(objectStreamClass.getName());
}
/**
* Tests that the class name conforms to requirements.
* <p>
* The reject list takes precedence over the accept list.
* </p>
*
* <p>
* Matchers receive the class name unchanged, including array descriptors such as {@code [Lcom.example.Foo;} for {@code com.example.Foo[]}.
* Array descriptors are not converted to element class names.
* </p>
*
* @param name The class name to test.
* @return true if the input is accepted, false if rejected, false if neither.
*/
public boolean test(final String name) {
// The reject list takes precedence over the accept list.
final Predicate<ClassNameMatcher> p = m -> m.matches(name);
return rejectMatchers.stream().noneMatch(p) && acceptMatchers.stream().anyMatch(p);
}
}