Class ObjectInputStreamWithClassloader

java.lang.Object
java.io.InputStream
java.io.ObjectInputStream
org.jgroups.util.ObjectInputStreamWithClassloader
All Implemented Interfaces:
Closeable, DataInput, ObjectInput, ObjectStreamConstants, AutoCloseable
public class ObjectInputStreamWithClassloader extends ObjectInputStream
Override ObjectInputStream.resolveClass(java.io.ObjectStreamClass) using the passed-in classloader.

This is the single point through which all JGroups Java-serialization based deserialization goes, both for RPC calls (e.g. MethodCall arguments/return values, via Util.objectFromStream(DataInput) and Util.objectFromByteBuffer(byte[])) and for state-transfer / replicated-map marshalling (e.g. ReplicatedHashMap,

invalid reference 
org.jgroups.blocks.PartitionedHashMap
). To harden this against unsafe deserialization (gadget-chain) attacks, a java.io.ObjectInputFilter (JEP 290) can be configured process-wide via the Global.DESERIALIZATION_FILTER system property; it is then applied to every stream created here.

java.io.ObjectInputFilter only exists since Java 9, but this module still targets Java 8, so the API is accessed via reflection (same technique already used for e.g. Loom fibers in

invalid reference 
Util#createFiber
): on a JVM that doesn't support it, FILTER stays null and filtering is simply skipped. Like every other jgroups.* system property in this codebase (see the static initializer in Util), the property is read once, when this class is loaded - it's not re-checked per stream. To change it, set it on the command line (or otherwise before JGroups classes are loaded), not at runtime.
Since:
3.5
Author:
Bela Ban