archive/jdk
1
0
Fork 0
mirror of https://github.com/openjdk/jdk.git synced 2025-08-27 06:45:07 +02:00
Code Issues Projects Releases Packages Wiki Activity Actions

8197595: Serialization javadoc should link to security best practices

Browse source 
Reviewed-by: lancea, mullan, ahgross
This commit is contained in:
Roger Riggs 2018-03-28 14:15:41 -04:00
parent 484ec0738e
commit e50e03e199
4 changed files with 36 additions and 11 deletions
Download patch file Download diff file Expand all files Collapse all files

8
src/java.base/share/classes/java/io/ObjectInputStream.java
View file

@ -52,6 +52,14 @@ import sun.reflect.misc.ReflectUtil;
* An ObjectInputStream deserializes primitive data and objects previously
* written using an ObjectOutputStream.
*
* <p><strong>Warning: Deserialization of untrusted data is inherently dangerous
* and should be avoided. Untrusted data should be carefully validated according to the
* "Serialization and Deserialization" section of the
* {@extLink secure_coding_guidelines_javase Secure Coding Guidelines for Java SE}.
* {@extLink serialization_filter_guide Serialization Filtering} describes best
* practices for defensive use of serial filters.
* </strong></p>
*
* <p>ObjectOutputStream and ObjectInputStream can provide an application with
* persistent storage for graphs of objects when used with a FileOutputStream
* and FileInputStream respectively. ObjectInputStream is used to recover