Class Serializer

java.lang.Object

org.jpos.util.Serializer

public class Serializer
extends Object

Java-serialization helpers with deserialization filters that reject known gadget-chain classes and enforce a depth limit.

Constructor Summary

Constructors

Constructor	Description
Serializer()	Utility class; instances carry no state.

Method Summary

Modifier and Type	Method	Description
static ObjectInputStream	createAllowListObjectInputStream(InputStream in, String... allowedPackages)	Creates an ObjectInputStream with an allow-list filter that only permits classes matching the specified packages or exact class names.
static ObjectInputStream	createSafeObjectInputStream(InputStream in)	Creates an ObjectInputStream with a deserialization filter that rejects known gadget-chain classes and enforces resource limits.
static Object	deserialize(byte[] b)	Deserializes the byte array using createSafeObjectInputStream(InputStream).
static <T> T	deserialize(byte[] b, Class<T> clazz)	Deserializes the byte array and casts the result to T.
static Map<String,String>	deserializeStringMap(byte[] buf)	Inverse of serializeStringMap(Map); only allows JDK collection/string classes.
static byte[]	serialize(Object obj)	Serializes obj into a byte array using standard Java serialization.
static <T> T	serializeDeserialize(T obj)	Round-trips an object through serialization and back, useful for deep-cloning.
static byte[]	serializeStringMap(Map<String,String> m)	Serializes a Map<String,String> using a compact entry-by-entry format.

Methods inherited from class Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Constructor Details

Serializer

public Serializer()

Utility class; instances carry no state.

Method Details

createSafeObjectInputStream

public static ObjectInputStream createSafeObjectInputStream(InputStream in)
                                                     throws IOException

Creates an ObjectInputStream with a deserialization filter that rejects known gadget-chain classes and enforces resource limits.

Parameters:

in - the underlying input stream

Returns:

a filtered ObjectInputStream

Throws:

IOException - if an I/O error occurs

createAllowListObjectInputStream

public static ObjectInputStream createAllowListObjectInputStream(InputStream in,
 String... allowedPackages)
                                                          throws IOException

Creates an ObjectInputStream with an allow-list filter that only permits classes matching the specified packages or exact class names.

Parameters:

in - the underlying input stream

allowedPackages - package prefixes to allow (e.g. "org.jpos.iso.")

Returns:

a filtered ObjectInputStream

Throws:

IOException - if an I/O error occurs

serialize

public static byte[] serialize(Object obj)
                        throws IOException

Serializes obj into a byte array using standard Java serialization.

Parameters:

obj - object to serialize

Returns:

the serialized byte array

Throws:

IOException - if writing fails

deserialize

public static Object deserialize(byte[] b)
                          throws IOException,
ClassNotFoundException

Deserializes the byte array using createSafeObjectInputStream(InputStream).

Parameters:

b - serialized bytes

Returns:

the deserialized object

Throws:

IOException - if reading fails

ClassNotFoundException - if a referenced class cannot be loaded

deserialize

public static <T> T deserialize(byte[] b,
 Class<T> clazz)
                         throws IOException,
ClassNotFoundException

Deserializes the byte array and casts the result to T.

Type Parameters:

T - expected concrete type

Parameters:

b - serialized bytes

clazz - expected class (used for the unchecked cast)

Returns:

the deserialized object

Throws:

IOException - if reading fails

ClassNotFoundException - if a referenced class cannot be loaded

serializeDeserialize

public static <T> T serializeDeserialize(T obj)
                                  throws IOException,
ClassNotFoundException

Round-trips an object through serialization and back, useful for deep-cloning.

Type Parameters:

T - object type

Parameters:

obj - object to clone

Returns:

a fresh deserialized copy of obj

Throws:

IOException - if serialization fails

ClassNotFoundException - if a referenced class cannot be loaded

serializeStringMap

public static byte[] serializeStringMap(Map<String,String> m)
                                 throws IOException

Serializes a Map<String,String> using a compact entry-by-entry format.

Parameters:

m - the map to serialize

Returns:

the serialized byte array

Throws:

IOException - if writing fails

deserializeStringMap

public static Map<String,String> deserializeStringMap(byte[] buf)
                                               throws ClassNotFoundException,
IOException

Inverse of serializeStringMap(Map); only allows JDK collection/string classes.

Parameters:

buf - the serialized bytes

Returns:

the deserialized map

Throws:

ClassNotFoundException - if a referenced class cannot be loaded

IOException - if reading fails