Skip to content
体验新版
项目
组织
正在加载...
登录
切换导航
打开侧边栏
爱吃血肠
spring-framework
提交
7d8aa05c
S
spring-framework
项目概览
爱吃血肠
/
spring-framework
通知
1
Star
0
Fork
0
代码
文件
提交
分支
Tags
贡献者
分支图
Diff
Issue
0
列表
看板
标记
里程碑
合并请求
0
Wiki
0
Wiki
分析
仓库
DevOps
项目成员
Pages
S
spring-framework
项目概览
项目概览
详情
发布
仓库
仓库
文件
提交
分支
标签
贡献者
分支图
比较
Issue
0
Issue
0
列表
看板
标记
里程碑
合并请求
0
合并请求
0
Pages
分析
分析
仓库分析
DevOps
Wiki
0
Wiki
成员
成员
收起侧边栏
关闭侧边栏
动态
分支图
创建新Issue
提交
Issue看板
体验新版 GitCode,发现更多精彩内容 >>
提交
7d8aa05c
编写于
7月 21, 2011
作者:
J
Juergen Hoeller
浏览文件
操作
浏览文件
下载
电子邮件补丁
差异文件
added "acceptProxyClasses" flag to RemoteInvocationSerializingExporter
上级
2c199cf1
变更
3
隐藏空白更改
内联
并排
Showing
3 changed file
with
62 addition
and
8 deletion
+62
-8
org.springframework.context/src/main/java/org/springframework/remoting/rmi/CodebaseAwareObjectInputStream.java
...ramework/remoting/rmi/CodebaseAwareObjectInputStream.java
+19
-3
org.springframework.context/src/main/java/org/springframework/remoting/rmi/RemoteInvocationSerializingExporter.java
...ork/remoting/rmi/RemoteInvocationSerializingExporter.java
+20
-3
org.springframework.core/src/main/java/org/springframework/core/ConfigurableObjectInputStream.java
...g/springframework/core/ConfigurableObjectInputStream.java
+23
-2
未找到文件。
org.springframework.context/src/main/java/org/springframework/remoting/rmi/CodebaseAwareObjectInputStream.java
浏览文件 @
7d8aa05c
/*
/*
* Copyright 2002-20
08
the original author or authors.
* Copyright 2002-20
11
the original author or authors.
*
*
* Licensed under the Apache License, Version 2.0 (the "License");
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
* you may not use this file except in compliance with the License.
...
@@ -57,7 +57,7 @@ public class CodebaseAwareObjectInputStream extends ConfigurableObjectInputStrea
...
@@ -57,7 +57,7 @@ public class CodebaseAwareObjectInputStream extends ConfigurableObjectInputStrea
/**
/**
* Create a new CodebaseAwareObjectInputStream for the given InputStream and codebase.
* Create a new CodebaseAwareObjectInputStream for the given InputStream and codebase.
* @param
in the InputStream to read from
* @param
in the InputStream to read from
* @param codebaseUrl the codebase URL to load classes from if not found locally
* @param codebaseUrl the codebase URL to load classes from if not found locally
* (can consist of multiple URLs, separated by spaces)
* (can consist of multiple URLs, separated by spaces)
* @see java.io.ObjectInputStream#ObjectInputStream(java.io.InputStream)
* @see java.io.ObjectInputStream#ObjectInputStream(java.io.InputStream)
...
@@ -68,7 +68,7 @@ public class CodebaseAwareObjectInputStream extends ConfigurableObjectInputStrea
...
@@ -68,7 +68,7 @@ public class CodebaseAwareObjectInputStream extends ConfigurableObjectInputStrea
/**
/**
* Create a new CodebaseAwareObjectInputStream for the given InputStream and codebase.
* Create a new CodebaseAwareObjectInputStream for the given InputStream and codebase.
* @param
in the InputStream to read from
* @param
in the InputStream to read from
* @param classLoader the ClassLoader to use for loading local classes
* @param classLoader the ClassLoader to use for loading local classes
* (may be <code>null</code> to indicate RMI's default ClassLoader)
* (may be <code>null</code> to indicate RMI's default ClassLoader)
* @param codebaseUrl the codebase URL to load classes from if not found locally
* @param codebaseUrl the codebase URL to load classes from if not found locally
...
@@ -82,6 +82,22 @@ public class CodebaseAwareObjectInputStream extends ConfigurableObjectInputStrea
...
@@ -82,6 +82,22 @@ public class CodebaseAwareObjectInputStream extends ConfigurableObjectInputStrea
this
.
codebaseUrl
=
codebaseUrl
;
this
.
codebaseUrl
=
codebaseUrl
;
}
}
/**
* Create a new CodebaseAwareObjectInputStream for the given InputStream and codebase.
* @param in the InputStream to read from
* @param classLoader the ClassLoader to use for loading local classes
* (may be <code>null</code> to indicate RMI's default ClassLoader)
* @param acceptProxyClasses whether to accept deserialization of proxy classes
* (may be deactivated as a security measure)
* @see java.io.ObjectInputStream#ObjectInputStream(java.io.InputStream)
*/
public
CodebaseAwareObjectInputStream
(
InputStream
in
,
ClassLoader
classLoader
,
boolean
acceptProxyClasses
)
throws
IOException
{
super
(
in
,
classLoader
,
acceptProxyClasses
);
this
.
codebaseUrl
=
null
;
}
@Override
@Override
protected
Class
resolveFallbackIfPossible
(
String
className
,
ClassNotFoundException
ex
)
protected
Class
resolveFallbackIfPossible
(
String
className
,
ClassNotFoundException
ex
)
...
...
org.springframework.context/src/main/java/org/springframework/remoting/rmi/RemoteInvocationSerializingExporter.java
浏览文件 @
7d8aa05c
/*
/*
* Copyright 2002-20
08
the original author or authors.
* Copyright 2002-20
11
the original author or authors.
*
*
* Licensed under the Apache License, Version 2.0 (the "License");
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
* you may not use this file except in compliance with the License.
...
@@ -57,6 +57,8 @@ public abstract class RemoteInvocationSerializingExporter extends RemoteInvocati
...
@@ -57,6 +57,8 @@ public abstract class RemoteInvocationSerializingExporter extends RemoteInvocati
private
String
contentType
=
CONTENT_TYPE_SERIALIZED_OBJECT
;
private
String
contentType
=
CONTENT_TYPE_SERIALIZED_OBJECT
;
private
boolean
acceptProxyClasses
=
true
;
private
Object
proxy
;
private
Object
proxy
;
...
@@ -70,12 +72,27 @@ public abstract class RemoteInvocationSerializingExporter extends RemoteInvocati
...
@@ -70,12 +72,27 @@ public abstract class RemoteInvocationSerializingExporter extends RemoteInvocati
}
}
/**
/**
* Return the content type to use for sending remote invocation
responses.
* Return the content type to use for sending remote invocation responses.
*/
*/
public
String
getContentType
()
{
public
String
getContentType
()
{
return
this
.
contentType
;
return
this
.
contentType
;
}
}
/**
* Set whether to accept deserialization of proxy classes.
* <p>Default is "true". May be deactivated as a security measure.
*/
public
void
setAcceptProxyClasses
(
boolean
acceptProxyClasses
)
{
this
.
acceptProxyClasses
=
acceptProxyClasses
;
}
/**
* Return whether to accept deserialization of proxy classes.
*/
public
boolean
isAcceptProxyClasses
()
{
return
this
.
acceptProxyClasses
;
}
public
void
afterPropertiesSet
()
{
public
void
afterPropertiesSet
()
{
prepare
();
prepare
();
...
@@ -102,7 +119,7 @@ public abstract class RemoteInvocationSerializingExporter extends RemoteInvocati
...
@@ -102,7 +119,7 @@ public abstract class RemoteInvocationSerializingExporter extends RemoteInvocati
* @throws java.io.IOException if creation of the ObjectInputStream failed
* @throws java.io.IOException if creation of the ObjectInputStream failed
*/
*/
protected
ObjectInputStream
createObjectInputStream
(
InputStream
is
)
throws
IOException
{
protected
ObjectInputStream
createObjectInputStream
(
InputStream
is
)
throws
IOException
{
return
new
CodebaseAwareObjectInputStream
(
is
,
getBeanClassLoader
(),
null
);
return
new
CodebaseAwareObjectInputStream
(
is
,
getBeanClassLoader
(),
isAcceptProxyClasses
()
);
}
}
/**
/**
...
...
org.springframework.core/src/main/java/org/springframework/core/ConfigurableObjectInputStream.java
浏览文件 @
7d8aa05c
/*
/*
* Copyright 2002-20
08
the original author or authors.
* Copyright 2002-20
11
the original author or authors.
*
*
* Licensed under the Apache License, Version 2.0 (the "License");
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
* you may not use this file except in compliance with the License.
...
@@ -18,6 +18,7 @@ package org.springframework.core;
...
@@ -18,6 +18,7 @@ package org.springframework.core;
import
java.io.IOException
;
import
java.io.IOException
;
import
java.io.InputStream
;
import
java.io.InputStream
;
import
java.io.NotSerializableException
;
import
java.io.ObjectInputStream
;
import
java.io.ObjectInputStream
;
import
java.io.ObjectStreamClass
;
import
java.io.ObjectStreamClass
;
import
java.lang.reflect.Proxy
;
import
java.lang.reflect.Proxy
;
...
@@ -36,16 +37,33 @@ public class ConfigurableObjectInputStream extends ObjectInputStream {
...
@@ -36,16 +37,33 @@ public class ConfigurableObjectInputStream extends ObjectInputStream {
private
final
ClassLoader
classLoader
;
private
final
ClassLoader
classLoader
;
private
final
boolean
acceptProxyClasses
;
/**
/**
* Create a new ConfigurableObjectInputStream for the given InputStream and ClassLoader.
* Create a new ConfigurableObjectInputStream for the given InputStream and ClassLoader.
* @param
in the InputStream to read from
* @param
in the InputStream to read from
* @param classLoader the ClassLoader to use for loading local classes
* @param classLoader the ClassLoader to use for loading local classes
* @see java.io.ObjectInputStream#ObjectInputStream(java.io.InputStream)
* @see java.io.ObjectInputStream#ObjectInputStream(java.io.InputStream)
*/
*/
public
ConfigurableObjectInputStream
(
InputStream
in
,
ClassLoader
classLoader
)
throws
IOException
{
public
ConfigurableObjectInputStream
(
InputStream
in
,
ClassLoader
classLoader
)
throws
IOException
{
this
(
in
,
classLoader
,
true
);
}
/**
* Create a new ConfigurableObjectInputStream for the given InputStream and ClassLoader.
* @param in the InputStream to read from
* @param classLoader the ClassLoader to use for loading local classes
* @param acceptProxyClasses whether to accept deserialization of proxy classes
* (may be deactivated as a security measure)
* @see java.io.ObjectInputStream#ObjectInputStream(java.io.InputStream)
*/
public
ConfigurableObjectInputStream
(
InputStream
in
,
ClassLoader
classLoader
,
boolean
acceptProxyClasses
)
throws
IOException
{
super
(
in
);
super
(
in
);
this
.
classLoader
=
classLoader
;
this
.
classLoader
=
classLoader
;
this
.
acceptProxyClasses
=
acceptProxyClasses
;
}
}
...
@@ -68,6 +86,9 @@ public class ConfigurableObjectInputStream extends ObjectInputStream {
...
@@ -68,6 +86,9 @@ public class ConfigurableObjectInputStream extends ObjectInputStream {
@Override
@Override
protected
Class
resolveProxyClass
(
String
[]
interfaces
)
throws
IOException
,
ClassNotFoundException
{
protected
Class
resolveProxyClass
(
String
[]
interfaces
)
throws
IOException
,
ClassNotFoundException
{
if
(!
this
.
acceptProxyClasses
)
{
throw
new
NotSerializableException
(
"Not allowed to accept serialized proxy classes"
);
}
if
(
this
.
classLoader
!=
null
)
{
if
(
this
.
classLoader
!=
null
)
{
// Use the specified ClassLoader to resolve local proxy classes.
// Use the specified ClassLoader to resolve local proxy classes.
Class
[]
resolvedInterfaces
=
new
Class
[
interfaces
.
length
];
Class
[]
resolvedInterfaces
=
new
Class
[
interfaces
.
length
];
...
...
编辑
预览
Markdown
is supported
0%
请重试
或
添加新附件
.
添加附件
取消
You are about to add
0
people
to the discussion. Proceed with caution.
先完成此消息的编辑!
取消
想要评论请
注册
或
登录