#5651

Committed 18 Jul 2026 03:26AM UTC coverage: 66.303% (-33.7%) from 100.0%

Build # #5651

Build Type

push

github

Committed by

ben-manes

Commit Message

dependency updates

Coverage Stats

2809 of 4164 branches covered (67.46%)

5584 of 8422 relevant lines covered (66.3%)

0.66 hits per line

Source File
Press 'n' to go to next uncovered line, 'b' for previous

0.0

/jcache/src/main/java/com/github/benmanes/caffeine/jcache/copy/JavaSerializationCopier.java

/*
 * Copyright 2015 Ben Manes. All Rights Reserved.
 *
 * Licensed under the Apache License, Version 2.0 (the "License");
 * you may not use this file except in compliance with the License.
 * You may obtain a copy of the License at
 *
 *     http://www.apache.org/licenses/LICENSE-2.0
 *
 * Unless required by applicable law or agreed to in writing, software
 * distributed under the License is distributed on an "AS IS" BASIS,
 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
 * See the License for the specific language governing permissions and
 * limitations under the License.
 */
package com.github.benmanes.caffeine.jcache.copy;

import static java.util.Objects.requireNonNull;

import java.io.ByteArrayInputStream;
import java.io.ByteArrayOutputStream;
import java.io.IOException;
import java.io.InputStream;
import java.io.ObjectInputFilter;
import java.io.ObjectInputStream;
import java.io.ObjectOutputStream;
import java.io.ObjectStreamClass;
import java.util.Map;
import java.util.Set;
import java.util.function.Function;

import javax.cache.CacheException;

import org.jspecify.annotations.NullMarked;
import org.jspecify.annotations.Nullable;

/**
 * A strategy that uses Java serialization if a fast path approach is not applicable.
 * <p>
 * Beware that Java serialization is slow, can be insecure, and is provided due to being required
 * by JSR-107. In practice, it is recommended that a higher performance alternative is used, which
 * is provided by numerous external libraries. If serialization must be used then consider supplying
 * an {@link ObjectInputFilter} or enabling
 * <a href="http://docs.oracle.com/en/java/javase/25/core/serialization-filtering1.html">
 * Serialization Filtering</a> to restrict the classes that can be deserialized.
 *
 * @author ben.manes@gmail.com (Ben Manes)
 */
@NullMarked
public class JavaSerializationCopier extends AbstractCopier<byte[]> {
  private final @Nullable ObjectInputFilter objectInputFilter;

  public JavaSerializationCopier() {
    this(javaImmutableClasses(), javaDeepCopyStrategies());
  }

  public JavaSerializationCopier(Set<Class<?>> immutableClasses,
      Map<Class<?>, Function<Object, Object>> deepCopyStrategies) {
    super(immutableClasses, deepCopyStrategies);
    this.objectInputFilter = null;
  }

  public JavaSerializationCopier(Set<Class<?>> immutableClasses,
      Map<Class<?>, Function<Object, Object>> deepCopyStrategies,
      ObjectInputFilter objectInputFilter) {
    super(immutableClasses, deepCopyStrategies);
    this.objectInputFilter = objectInputFilter;
  }

  @Override
  protected byte[] serialize(Object object) {
    var bytes = new ByteArrayOutputStream();
    try (var output = new ObjectOutputStream(bytes)) {
      output.writeObject(object);
    } catch (IOException e) {
      throw new CacheException("Failed to serialize " + object.getClass(), e);
    }
    return bytes.toByteArray();
  }

  @Override
  @SuppressWarnings("BanSerializableRead")
  protected Object deserialize(byte[] data, ClassLoader classLoader) {
    try (var bytes = new ByteArrayInputStream(data);
         var input = newInputStream(bytes, classLoader)) {
      return input.readObject();
    } catch (IOException e) {
      throw new CacheException("Failed to deserialize", e);
    } catch (ClassNotFoundException e) {
      throw new CacheException("Failed to resolve a deserialized class", e);
    }
  }

  // @VisibleForTesting
  ObjectInputStream newInputStream(
      InputStream in, ClassLoader classLoader) throws IOException {
    var stream = new ClassLoaderAwareObjectInputStream(in, classLoader);
    if (objectInputFilter != null) {
      stream.setObjectInputFilter(objectInputFilter);
    }
    return stream;
  }

  /** An {@linkplain ObjectInputStream} that instantiates using the supplied classloader. */
  protected static class ClassLoaderAwareObjectInputStream extends ObjectInputStream {
    private final ClassLoader classLoader;

    public ClassLoaderAwareObjectInputStream(InputStream in, ClassLoader classLoader)
        throws IOException {
      super(in);
      this.classLoader = requireNonNull(classLoader);
    }

    protected ClassLoader getClassLoader() {
      return classLoader;
    }

    @Override
    @SuppressWarnings("BanSerializableRead")
    protected Class<?> resolveClass(ObjectStreamClass desc)
        throws IOException, ClassNotFoundException {
      try {
        return Class.forName(desc.getName(), /* initialize= */ false, getClassLoader());
      } catch (ClassNotFoundException ignored) {
        return super.resolveClass(desc);
      }
    }
  }
}

1	/*
2	* Copyright 2015 Ben Manes. All Rights Reserved.
3	*
4	* Licensed under the Apache License, Version 2.0 (the "License");
5	* you may not use this file except in compliance with the License.
6	* You may obtain a copy of the License at
7	*
8	* http://www.apache.org/licenses/LICENSE-2.0
9	*
10	* Unless required by applicable law or agreed to in writing, software
11	* distributed under the License is distributed on an "AS IS" BASIS,
12	* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13	* See the License for the specific language governing permissions and
14	* limitations under the License.
15	*/
16	package com.github.benmanes.caffeine.jcache.copy;
17
18	import static java.util.Objects.requireNonNull;
19
20	import java.io.ByteArrayInputStream;
21	import java.io.ByteArrayOutputStream;
22	import java.io.IOException;
23	import java.io.InputStream;
24	import java.io.ObjectInputFilter;
25	import java.io.ObjectInputStream;
26	import java.io.ObjectOutputStream;
27	import java.io.ObjectStreamClass;
28	import java.util.Map;
29	import java.util.Set;
30	import java.util.function.Function;
31
32	import javax.cache.CacheException;
33
34	import org.jspecify.annotations.NullMarked;
35	import org.jspecify.annotations.Nullable;
36
37	/**
38	* A strategy that uses Java serialization if a fast path approach is not applicable.
39	* <p>
40	* Beware that Java serialization is slow, can be insecure, and is provided due to being required
41	* by JSR-107. In practice, it is recommended that a higher performance alternative is used, which
42	* is provided by numerous external libraries. If serialization must be used then consider supplying
43	* an {@link ObjectInputFilter} or enabling
44	* <a href="http://docs.oracle.com/en/java/javase/25/core/serialization-filtering1.html">
45	* Serialization Filtering</a> to restrict the classes that can be deserialized.
46	*
47	* @author ben.manes@gmail.com (Ben Manes)
48	*/
49	@NullMarked
50	public class JavaSerializationCopier extends AbstractCopier<byte[]> {
51	private final @Nullable ObjectInputFilter objectInputFilter;
52
53	public JavaSerializationCopier() {
54	this(javaImmutableClasses(), javaDeepCopyStrategies());	×
55	}	×
56
57	public JavaSerializationCopier(Set<Class<?>> immutableClasses,
58	Map<Class<?>, Function<Object, Object>> deepCopyStrategies) {
59	super(immutableClasses, deepCopyStrategies);	×
60	this.objectInputFilter = null;	×
61	}	×
62
63	public JavaSerializationCopier(Set<Class<?>> immutableClasses,
64	Map<Class<?>, Function<Object, Object>> deepCopyStrategies,
65	ObjectInputFilter objectInputFilter) {
66	super(immutableClasses, deepCopyStrategies);	×
67	this.objectInputFilter = objectInputFilter;	×
68	}	×
69
70	@Override
71	protected byte[] serialize(Object object) {
72	var bytes = new ByteArrayOutputStream();	×
73	try (var output = new ObjectOutputStream(bytes)) {	×
74	output.writeObject(object);	×
75	} catch (IOException e) {	×
76	throw new CacheException("Failed to serialize " + object.getClass(), e);	×
77	}	×
78	return bytes.toByteArray();	×
79	}
80
81	@Override
82	@SuppressWarnings("BanSerializableRead")
83	protected Object deserialize(byte[] data, ClassLoader classLoader) {
84	try (var bytes = new ByteArrayInputStream(data);	×
85	var input = newInputStream(bytes, classLoader)) {	×
86	return input.readObject();	×
87	} catch (IOException e) {	×
88	throw new CacheException("Failed to deserialize", e);	×
89	} catch (ClassNotFoundException e) {	×
90	throw new CacheException("Failed to resolve a deserialized class", e);	×
91	}
92	}
93
94	// @VisibleForTesting
95	ObjectInputStream newInputStream(
96	InputStream in, ClassLoader classLoader) throws IOException {
97	var stream = new ClassLoaderAwareObjectInputStream(in, classLoader);	×
98	if (objectInputFilter != null) {	×
99	stream.setObjectInputFilter(objectInputFilter);	×
100	}
101	return stream;	×
102	}
103
104	/** An {@linkplain ObjectInputStream} that instantiates using the supplied classloader. */
105	protected static class ClassLoaderAwareObjectInputStream extends ObjectInputStream {
106	private final ClassLoader classLoader;
107
108	public ClassLoaderAwareObjectInputStream(InputStream in, ClassLoader classLoader)
109	throws IOException {
110	super(in);	×
111	this.classLoader = requireNonNull(classLoader);	×
112	}	×
113
114	protected ClassLoader getClassLoader() {
115	return classLoader;	×
116	}
117
118	@Override
119	@SuppressWarnings("BanSerializableRead")
120	protected Class<?> resolveClass(ObjectStreamClass desc)
121	throws IOException, ClassNotFoundException {
122	try {
123	return Class.forName(desc.getName(), /* initialize= */ false, getClassLoader());	×
124	} catch (ClassNotFoundException ignored) {	×
125	return super.resolveClass(desc);	×
126	}
127	}
128	}
129	}

ben-manes / caffeine / #5651

Source File Press 'n' to go to next uncovered line, 'b' for previous

Source File
Press 'n' to go to next uncovered line, 'b' for previous