Class SerializingHttpMessageConverter

java.lang.Object

org.springframework.http.converter.AbstractHttpMessageConverter<Serializable>

org.springframework.integration.http.converter.SerializingHttpMessageConverter

All Implemented Interfaces:

HttpMessageConverter<Serializable>

public class SerializingHttpMessageConverter
extends AbstractHttpMessageConverter<Serializable>

An HttpMessageConverter implementation for Serializable instances.

Incoming requests are deserialized through an AllowListDeserializingConverter. For backward compatibility no class restriction is applied by default; when this converter is used to read requests from untrusted sources, configure an allowlist of trusted classes/packages via setAllowedPatterns(String...) or addAllowedPatterns(String...) to guard against unsafe Java deserialization.

Since:

2.0

Author:

Mark Fisher, Gary Russell, Artem Bilan, Uwez Khan

Field Summary

Fields inherited from class AbstractHttpMessageConverter

logger

Constructor Summary

Constructors

Constructor	Description
SerializingHttpMessageConverter()	Creates a new instance of the SerializingHttpMessageConverter.

Method Summary

Modifier and Type	Method	Description
void	addAllowedPatterns(String... allowedPatterns)	Add package/class patterns to the allowed list.
boolean	canWrite(Class<?> clazz, @Nullable MediaType mediaType)
Serializable	readInternal(Class<? extends Serializable> clazz, HttpInputMessage inputMessage)
void	setAllowedPatterns(String... allowedPatterns)	Set simple patterns for allowable packages/classes for deserialization.
boolean	supports(Class<?> clazz)
protected void	writeInternal(Serializable object, HttpOutputMessage outputMessage)

Methods inherited from class AbstractHttpMessageConverter

addDefaultHeaders, canRead, canRead, canWrite, getContentLength, getDefaultCharset, getDefaultContentType, getSupportedMediaTypes, read, setDefaultCharset, setSupportedMediaTypes, supportsRepeatableWrites, write

Methods inherited from class Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Methods inherited from interface HttpMessageConverter

canWriteRepeatedly, getSupportedMediaTypes

Constructor Details

SerializingHttpMessageConverter

public SerializingHttpMessageConverter()

Creates a new instance of the SerializingHttpMessageConverter.

Method Details

setAllowedPatterns

public void setAllowedPatterns(String... allowedPatterns)

Set simple patterns for allowable packages/classes for deserialization. The patterns will be applied in order until a match is found. A class can be fully qualified, or a wildcard '*' is allowed at the beginning or end of the class name. Examples: com.foo.*, *.MyClass. The basic types (String, Number, arrays and primitives) are always allowed. When no patterns are configured, all classes are deserialized (the previous, unrestricted behavior).

Parameters:

allowedPatterns - the patterns.

Since:

5.5.22

addAllowedPatterns

public void addAllowedPatterns(String... allowedPatterns)

Add package/class patterns to the allowed list.

Parameters:

allowedPatterns - the patterns to add.

Since:

5.5.22

See Also:

• setAllowedPatterns(String...)

supports

public boolean supports(Class<?> clazz)

Specified by:

supports in class AbstractHttpMessageConverter<Serializable>

canWrite

public boolean canWrite(Class<?> clazz,
 @Nullable MediaType mediaType)

Specified by:

canWrite in interface HttpMessageConverter<Serializable>

Overrides:

canWrite in class AbstractHttpMessageConverter<Serializable>

readInternal

public Serializable readInternal(Class<? extends Serializable> clazz,
 HttpInputMessage inputMessage)
                          throws IOException

Specified by:

readInternal in class AbstractHttpMessageConverter<Serializable>

Throws:

IOException

writeInternal

protected void writeInternal(Serializable object,
 HttpOutputMessage outputMessage)
                      throws IOException

Specified by:

writeInternal in class AbstractHttpMessageConverter<Serializable>

Throws:

IOException