Page History

import java.io.*;
import java.util.*;

class LookAheadObjectInputStreamWhitelistedObjectInputStream extends ObjectInputStream {
  public LookAheadObjectInputStream Set whitelist;

  public WhitelistedObjectInputStream(InputStream inputStream, Set wl) throws IOException {
    super(inputStream);
    whitelist = wl;
  }
 
  @Override
  protected Class<?> resolveClass(ObjectStreamClass desccls) throws IOException, ClassNotFoundException {
    switchif (!whitelist.contains(desccls.getName())) {
      case "GoodClass1": break;
      case "GoodClass2": break;
      default:	
        throw new InvalidClassException("Unexpected serialized class", desccls.getName());
    }
    return super.resolveClass(desccls);
  }
}
 
class DeserializeExample {
  private static Object deserialize(byte[] buffer) throws IOException, ClassNotFoundException {
    Object ret = null;
    Set whitelist = new HashSet<String>(Arrays.asList(new String[]{"GoodClass1"}));
    try (ByteArrayInputStream bais = new ByteArrayInputStream(buffer)) {
      try (LookAheadObjectInputStreamWhitelistedObjectInputStream ois = new LookAheadObjectInputStreamWhitelistedObjectInputStream(bais, whitelist)) {
        ret = ois.readObject();
      }
    }
    return ret;
  } 
}