Package org.springframework.integration.http.converter

Class SerializingHttpMessageConverter

java.lang.Object

org.springframework.http.converter.AbstractHttpMessageConverter<Serializable>

org.springframework.integration.http.converter.SerializingHttpMessageConverter

All Implemented Interfaces:

HttpMessageConverter<Serializable>

public class SerializingHttpMessageConverter
extends AbstractHttpMessageConverter<Serializable>

An HttpMessageConverter implementation for Serializable instances.

Incoming requests are deserialized through an AllowListDeserializingConverter. To guard against unsafe Java deserialization, the patterns of trusted classes/packages are provided via the SerializingHttpMessageConverter(String...) constructor and can be extended with addAllowedPatterns(String...). For backward compatibility, no class restriction is applied when the deprecated default constructor is used and no patterns are configured.

Since:

2.0

Author:

Mark Fisher, Gary Russell, Artem Bilan, Uwez Khan, Hyun Lee

Field Summary

Fields inherited from class org.springframework.http.converter.AbstractHttpMessageConverter

logger

Constructor Summary

Constructors

Constructor	Description
SerializingHttpMessageConverter()	Deprecated, for removal: This API element is subject to removal in a future version. Since 7.2 in favor of SerializingHttpMessageConverter(String...) with an explicit list of allowed patterns.
SerializingHttpMessageConverter(String... allowedPatterns)	Create a new instance with simple patterns for allowable packages/classes for deserialization.

Method Summary

Modifier and Type	Method	Description
void	addAllowedPatterns(String... allowedPatterns)	Add package/class patterns to the allowed list.
boolean	canWrite(Class<?> clazz, @Nullable MediaType mediaType)
Serializable	readInternal(Class<? extends Serializable> clazz, HttpInputMessage inputMessage)
void	setAllowedPatterns(String... allowedPatterns)	Deprecated, for removal: This API element is subject to removal in a future version. Since 7.2 in favor of SerializingHttpMessageConverter(String...).
boolean	supports(Class<?> clazz)
protected void	writeInternal(Serializable object, HttpOutputMessage outputMessage)

Methods inherited from class org.springframework.http.converter.AbstractHttpMessageConverter

addDefaultHeaders, canRead, canRead, canWrite, getContentLength, getDefaultCharset, getDefaultContentType, getSupportedMediaTypes, read, setDefaultCharset, setSupportedMediaTypes, supportsRepeatableWrites, write

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Methods inherited from interface org.springframework.http.converter.HttpMessageConverter

canWriteRepeatedly, getSupportedMediaTypes

Constructor Details

SerializingHttpMessageConverter

@Deprecated(since="7.2",
            forRemoval=true)
public SerializingHttpMessageConverter()

Deprecated, for removal: This API element is subject to removal in a future version.

Since 7.2 in favor of SerializingHttpMessageConverter(String...) with an explicit list of allowed patterns.

Creates a new instance of the SerializingHttpMessageConverter.

SerializingHttpMessageConverter

public SerializingHttpMessageConverter(String... allowedPatterns)

Create a new instance with simple patterns for allowable packages/classes for deserialization. The patterns will be applied in order until a match is found. A class can be fully qualified, or a wildcard '*' is allowed at the beginning or end of the class name. Examples: com.example.*, *.MyClass. The basic types (String, Number, arrays and primitives) are always allowed.

Parameters:

allowedPatterns - the patterns; must not be empty.

Since:

7.2

Method Details

setAllowedPatterns

@Deprecated(since="7.2",
            forRemoval=true)
public void setAllowedPatterns(String... allowedPatterns)

Deprecated, for removal: This API element is subject to removal in a future version.

Since 7.2 in favor of SerializingHttpMessageConverter(String...).

Set simple patterns for allowable packages/classes for deserialization. The patterns will be applied in order until a match is found. A class can be fully qualified, or a wildcard '*' is allowed at the beginning or end of the class name. Examples: com.foo.*, *.MyClass. The basic types (String, Number, arrays and primitives) are always allowed. When no patterns are configured, all classes are deserialized (the previous, unrestricted behavior).

Parameters:

allowedPatterns - the patterns.

Since:

5.5.22

addAllowedPatterns

public void addAllowedPatterns(String... allowedPatterns)

Add package/class patterns to the allowed list.

Parameters:

allowedPatterns - the patterns to add.

Since:

5.5.22

See Also:

• SerializingHttpMessageConverter(String...)

supports

public boolean supports(Class<?> clazz)

Specified by:

supports in class AbstractHttpMessageConverter<Serializable>

canWrite

public boolean canWrite(Class<?> clazz,
 @Nullable MediaType mediaType)

Specified by:

canWrite in interface HttpMessageConverter<Serializable>

Overrides:

canWrite in class AbstractHttpMessageConverter<Serializable>

readInternal

public Serializable readInternal(Class<? extends Serializable> clazz,
 HttpInputMessage inputMessage)
                          throws IOException

Specified by:

readInternal in class AbstractHttpMessageConverter<Serializable>

Throws:

IOException

writeInternal

protected void writeInternal(Serializable object,
 HttpOutputMessage outputMessage)
                      throws IOException

Specified by:

writeInternal in class AbstractHttpMessageConverter<Serializable>

Throws:

IOException