jdk-sandbox: comparison jdk/src/java.rmi/share/classes/java/rmi/MarshalledObject.java

equal deleted inserted replaced

-:570fbef3a53b
+:f264afd5082c
 /*
-* Copyright (c) 1997, 2013, Oracle and/or its affiliates. All rights reserved.
+* Copyright (c) 1997, 2016, Oracle and/or its affiliates. All rights reserved.
 * DO NOT ALTER OR REMOVE COPYRIGHT NOTICES OR THIS FILE HEADER.
 *
 * This code is free software; you can redistribute it and/or modify it
 * under the terms of the GNU General Public License version 2 only, as
 * published by the Free Software Foundation.  Oracle designates this
 import java.io.ByteArrayInputStream;
 import java.io.ByteArrayOutputStream;
 import java.io.IOException;
 import java.io.InputStream;
+import java.io.ObjectInputFilter;
 import java.io.ObjectInputStream;
 import java.io.ObjectOutputStream;
 import java.io.ObjectStreamConstants;
 import java.io.OutputStream;
 import java.io.Serializable;
+import java.security.AccessController;
+import java.security.PrivilegedAction;
 import sun.rmi.server.MarshalInputStream;
 import sun.rmi.server.MarshalOutputStream;
 /**
 * A <code>MarshalledObject</code> contains a byte stream with the serialized
 * @serial Stored hash code of contained object.
 *
 * @see #hashCode
 */
 private int hash;
+/** Filter used when creating the instance from a stream; may be null. */
+private transient ObjectInputFilter objectInputFilter = null;
 /** Indicate compatibility with 1.2 version of class. */
 private static final long serialVersionUID = 8988374069173025854L;
 /**
 }
 hash = h;
 }
 /**
+* Reads in the state of the object and saves the stream's
+* serialization filter to be used when the object is deserialized.
+*
+* @param stream the stream
+* @throws IOException if an I/O error occurs
+* @throws ClassNotFoundException if a class cannot be found
+*/
+private void readObject(ObjectInputStream stream)
+throws IOException, ClassNotFoundException {
+stream.defaultReadObject();     // read in all fields
+objectInputFilter = stream.getObjectInputFilter();
+}
+/**
 * Returns a new copy of the contained marshalledobject.  The internal
 * representation is deserialized with the semantics used for
 * unmarshaling parameters for RMI calls.
+* If the MarshalledObject was read from an ObjectInputStream,
+* the filter from that stream is used to deserialize the object.
 *
 * @return a copy of the contained object
 * @exception IOException if an <code>IOException</code> occurs while
 * deserializing the object from its internal representation.
 * @exception ClassNotFoundException if a
 ByteArrayInputStream bin = new ByteArrayInputStream(objBytes);
 // locBytes is null if no annotations
 ByteArrayInputStream lin =
 (locBytes == null ? null : new ByteArrayInputStream(locBytes));
 MarshalledObjectInputStream in =
-new MarshalledObjectInputStream(bin, lin);
+new MarshalledObjectInputStream(bin, lin, objectInputFilter);
 @SuppressWarnings("unchecked")
 T obj = (T) in.readObject();
 in.close();
 return obj;
 }
 * reads its objects from <code>objIn</code> and annotations
 * from <code>locIn</code>.  If <code>locIn</code> is
 * <code>null</code>, then all annotations will be
 * <code>null</code>.
 */
-MarshalledObjectInputStream(InputStream objIn, InputStream locIn)
+MarshalledObjectInputStream(InputStream objIn, InputStream locIn,
+ObjectInputFilter filter)
 throws IOException
 {
 super(objIn);
 this.locIn = (locIn == null ? null : new ObjectInputStream(locIn));
+if (filter != null) {
+AccessController.doPrivileged((PrivilegedAction<Void>) () -> {
+MarshalledObjectInputStream.this.setObjectInputFilter(filter);
+if (MarshalledObjectInputStream.this.locIn != null) {
+MarshalledObjectInputStream.this.locIn.setObjectInputFilter(filter);
+}
+return null;
+});
+}
 }
 /**
 * Overrides MarshalInputStream.readLocation to return locations from
 * the stream we were given, or <code>null</code> if we were given a

changeset 43211	f264afd5082c
parent 25859	3317bb8137f4