#5731

Committed 17 Aug 2026 06:26AM UTC coverage: 99.866% (-0.1%) from 99.989%

Build # #5731

Build Type

push

github

Committed by

ben-manes

Commit Message

fix performance issues and test coverage gaps found by the audit sweep

- Budget the reference queue drains per maintenance cycle
- Leave an unpublished write buffer slot for its own producer
- Probe an async hit's readiness only where a policy reads it

Coverage Stats

4540 of 4558 branches covered (99.61%)

17 of 17 new or added lines in 1 file covered. (100.0%)

11 existing lines in 4 files now uncovered.

8957 of 8969 relevant lines covered (99.87%)

1.0 hits per line

Source File
Press 'n' to go to next uncovered line, 'b' for previous

94.87

/jcache/src/main/java/com/github/benmanes/caffeine/jcache/copy/JavaSerializationCopier.java

/*
 * Copyright 2015 Ben Manes. All Rights Reserved.
 *
 * Licensed under the Apache License, Version 2.0 (the "License");
 * you may not use this file except in compliance with the License.
 * You may obtain a copy of the License at
 *
 *     http://www.apache.org/licenses/LICENSE-2.0
 *
 * Unless required by applicable law or agreed to in writing, software
 * distributed under the License is distributed on an "AS IS" BASIS,
 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
 * See the License for the specific language governing permissions and
 * limitations under the License.
 */
package com.github.benmanes.caffeine.jcache.copy;

import static java.util.Objects.requireNonNull;

import java.io.ByteArrayInputStream;
import java.io.ByteArrayOutputStream;
import java.io.IOException;
import java.io.InputStream;
import java.io.ObjectInputFilter;
import java.io.ObjectInputStream;
import java.io.ObjectOutputStream;
import java.io.ObjectStreamClass;
import java.lang.reflect.Proxy;
import java.util.Map;
import java.util.Set;
import java.util.function.Function;

import javax.cache.CacheException;

import org.jspecify.annotations.NullMarked;
import org.jspecify.annotations.Nullable;

/**
 * A strategy that uses Java serialization if a fast path approach is not applicable.
 * <p>
 * Beware that Java serialization is slow, can be insecure, and is provided due to being required
 * by JSR-107. In practice, it is recommended that a higher performance alternative is used, which
 * is provided by numerous external libraries. If serialization must be used then consider supplying
 * an {@link ObjectInputFilter} or enabling
 * <a href="http://docs.oracle.com/en/java/javase/25/core/serialization-filtering1.html">
 * Serialization Filtering</a> to restrict the classes that can be deserialized.
 *
 * @author ben.manes@gmail.com (Ben Manes)
 */
@NullMarked
public class JavaSerializationCopier extends AbstractCopier<byte[]> {
  private final @Nullable ObjectInputFilter objectInputFilter;

  public JavaSerializationCopier() {
    this(javaImmutableClasses(), javaDeepCopyStrategies());
  }

  public JavaSerializationCopier(Set<Class<?>> immutableClasses,
      Map<Class<?>, Function<Object, Object>> deepCopyStrategies) {
    super(immutableClasses, deepCopyStrategies);
    this.objectInputFilter = null;
  }

  public JavaSerializationCopier(Set<Class<?>> immutableClasses,
      Map<Class<?>, Function<Object, Object>> deepCopyStrategies,
      ObjectInputFilter objectInputFilter) {
    super(immutableClasses, deepCopyStrategies);
    this.objectInputFilter = objectInputFilter;
  }

  @Override
  protected byte[] serialize(Object object) {
    var bytes = new ByteArrayOutputStream();
    try (var output = new ObjectOutputStream(bytes)) {
      output.writeObject(object);
    } catch (IOException e) {
      throw new CacheException("Failed to serialize " + object.getClass(), e);
    }
    return bytes.toByteArray();
  }

  @Override
  @SuppressWarnings("BanSerializableRead")
  protected Object deserialize(byte[] data, ClassLoader classLoader) {
    try (var bytes = new ByteArrayInputStream(data);
         var input = newInputStream(bytes, classLoader)) {
      return input.readObject();
    } catch (IOException e) {
      throw new CacheException("Failed to deserialize", e);
    } catch (ClassNotFoundException e) {
      throw new CacheException("Failed to resolve a deserialized class", e);
    }
  }

  // @VisibleForTesting
  ObjectInputStream newInputStream(
      InputStream in, ClassLoader classLoader) throws IOException {
    var stream = new ClassLoaderAwareObjectInputStream(in, classLoader);
    if (objectInputFilter != null) {
      stream.setObjectInputFilter(objectInputFilter);
    }
    return stream;
  }

  /** An {@linkplain ObjectInputStream} that instantiates using the supplied classloader. */
  protected static class ClassLoaderAwareObjectInputStream extends ObjectInputStream {
    private final ClassLoader classLoader;

    public ClassLoaderAwareObjectInputStream(InputStream in, ClassLoader classLoader)
        throws IOException {
      super(in);
      this.classLoader = requireNonNull(classLoader);
    }

    protected ClassLoader getClassLoader() {
      return classLoader;
    }

    @Override
    @SuppressWarnings("BanSerializableRead")
    protected Class<?> resolveClass(ObjectStreamClass desc)
        throws IOException, ClassNotFoundException {
      try {
        return Class.forName(desc.getName(), /* initialize= */ false, getClassLoader());
      } catch (ClassNotFoundException ignored) {
        return super.resolveClass(desc);
      }
    }

    @Override
    @SuppressWarnings({"BanSerializableRead", "deprecation"})
    protected Class<?> resolveProxyClass(String[] interfaces)
        throws IOException, ClassNotFoundException {
      try {
        var classes = new Class<?>[interfaces.length];
        for (int i = 0; i < interfaces.length; i++) {
          classes[i] = Class.forName(interfaces[i], /* initialize= */ false, getClassLoader());
        }
        return Proxy.getProxyClass(getClassLoader(), classes);
      } catch (ClassNotFoundException | IllegalArgumentException ignored) {
        return super.resolveProxyClass(interfaces);
      }
    }
  }
}

1	/*
2	* Copyright 2015 Ben Manes. All Rights Reserved.
3	*
4	* Licensed under the Apache License, Version 2.0 (the "License");
5	* you may not use this file except in compliance with the License.
6	* You may obtain a copy of the License at
7	*
8	* http://www.apache.org/licenses/LICENSE-2.0
9	*
10	* Unless required by applicable law or agreed to in writing, software
11	* distributed under the License is distributed on an "AS IS" BASIS,
12	* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13	* See the License for the specific language governing permissions and
14	* limitations under the License.
15	*/
16	package com.github.benmanes.caffeine.jcache.copy;
17
18	import static java.util.Objects.requireNonNull;
19
20	import java.io.ByteArrayInputStream;
21	import java.io.ByteArrayOutputStream;
22	import java.io.IOException;
23	import java.io.InputStream;
24	import java.io.ObjectInputFilter;
25	import java.io.ObjectInputStream;
26	import java.io.ObjectOutputStream;
27	import java.io.ObjectStreamClass;
28	import java.lang.reflect.Proxy;
29	import java.util.Map;
30	import java.util.Set;
31	import java.util.function.Function;
32
33	import javax.cache.CacheException;
34
35	import org.jspecify.annotations.NullMarked;
36	import org.jspecify.annotations.Nullable;
37
38	/**
39	* A strategy that uses Java serialization if a fast path approach is not applicable.
40	* <p>
41	* Beware that Java serialization is slow, can be insecure, and is provided due to being required
42	* by JSR-107. In practice, it is recommended that a higher performance alternative is used, which
43	* is provided by numerous external libraries. If serialization must be used then consider supplying
44	* an {@link ObjectInputFilter} or enabling
45	* <a href="http://docs.oracle.com/en/java/javase/25/core/serialization-filtering1.html">
46	* Serialization Filtering</a> to restrict the classes that can be deserialized.
47	*
48	* @author ben.manes@gmail.com (Ben Manes)
49	*/
50	@NullMarked
51	public class JavaSerializationCopier extends AbstractCopier<byte[]> {
52	private final @Nullable ObjectInputFilter objectInputFilter;
53
54	public JavaSerializationCopier() {
55	this(javaImmutableClasses(), javaDeepCopyStrategies());	1✔
56	}	1✔
57
58	public JavaSerializationCopier(Set<Class<?>> immutableClasses,
59	Map<Class<?>, Function<Object, Object>> deepCopyStrategies) {
60	super(immutableClasses, deepCopyStrategies);	1✔
61	this.objectInputFilter = null;	1✔
62	}	1✔
63
64	public JavaSerializationCopier(Set<Class<?>> immutableClasses,
65	Map<Class<?>, Function<Object, Object>> deepCopyStrategies,
66	ObjectInputFilter objectInputFilter) {
67	super(immutableClasses, deepCopyStrategies);	1✔
68	this.objectInputFilter = objectInputFilter;	1✔
69	}	1✔
70
71	@Override
72	protected byte[] serialize(Object object) {
73	var bytes = new ByteArrayOutputStream();	1✔
74	try (var output = new ObjectOutputStream(bytes)) {	1✔
75	output.writeObject(object);	1✔
76	} catch (IOException e) {	1✔
77	throw new CacheException("Failed to serialize " + object.getClass(), e);	1✔
78	}	1✔
79	return bytes.toByteArray();	1✔
80	}
81
82	@Override
83	@SuppressWarnings("BanSerializableRead")
84	protected Object deserialize(byte[] data, ClassLoader classLoader) {
85	try (var bytes = new ByteArrayInputStream(data);	1✔
86	var input = newInputStream(bytes, classLoader)) {	1✔
87	return input.readObject();	1✔
88	} catch (IOException e) {	1✔
89	throw new CacheException("Failed to deserialize", e);	1✔
90	} catch (ClassNotFoundException e) {	1✔
91	throw new CacheException("Failed to resolve a deserialized class", e);	1✔
92	}
93	}
94
95	// @VisibleForTesting
96	ObjectInputStream newInputStream(
97	InputStream in, ClassLoader classLoader) throws IOException {
98	var stream = new ClassLoaderAwareObjectInputStream(in, classLoader);	1✔
99	if (objectInputFilter != null) {	1✔
100	stream.setObjectInputFilter(objectInputFilter);	1✔
101	}
102	return stream;	1✔
103	}
104
105	/** An {@linkplain ObjectInputStream} that instantiates using the supplied classloader. */
106	protected static class ClassLoaderAwareObjectInputStream extends ObjectInputStream {
107	private final ClassLoader classLoader;
108
109	public ClassLoaderAwareObjectInputStream(InputStream in, ClassLoader classLoader)
110	throws IOException {
111	super(in);	1✔
112	this.classLoader = requireNonNull(classLoader);	1✔
113	}	1✔
114
115	protected ClassLoader getClassLoader() {
116	return classLoader;	1✔
117	}
118
119	@Override
120	@SuppressWarnings("BanSerializableRead")
121	protected Class<?> resolveClass(ObjectStreamClass desc)
122	throws IOException, ClassNotFoundException {
123	try {
124	return Class.forName(desc.getName(), /* initialize= */ false, getClassLoader());	1✔
125	} catch (ClassNotFoundException ignored) {	1✔
126	return super.resolveClass(desc);	1✔
127	}
128	}
129
130	@Override
131	@SuppressWarnings({"BanSerializableRead", "deprecation"})
132	protected Class<?> resolveProxyClass(String[] interfaces)
133	throws IOException, ClassNotFoundException {
134	try {
135	var classes = new Class<?>[interfaces.length];	1✔
136	for (int i = 0; i < interfaces.length; i++) {	1✔
137	classes[i] = Class.forName(interfaces[i], /* initialize= */ false, getClassLoader());	1✔
138	}
139	return Proxy.getProxyClass(getClassLoader(), classes);	1✔
UNCOV 140	} catch (ClassNotFoundException \| IllegalArgumentException ignored) {	×
UNCOV 141	return super.resolveProxyClass(interfaces);	×
142	}
143	}
144	}
145	}

ben-manes / caffeine / #5731

Source File Press 'n' to go to next uncovered line, 'b' for previous

Source File
Press 'n' to go to next uncovered line, 'b' for previous