Optimize class name validation from O(N) to O(1).
Better Javadoc.
Better specification of the JRE "java.time" package.
Package name validation is still O(N).
@@ -25,30 +25,31 @@ import java.util.Arrays;
import java.util.Collection;
import java.util.Collections;
import java.util.HashSet;
-import java.util.List;
+import java.util.Set;
/**
- * Extended ObjectInputStream that only allows certain classes to be deserialized.
+ * Extends {@link ObjectInputStream} to only allow some built-in Log4j classes and caller-specified classes to be
+ * deserialized.
*
* @since 2.8.2
*/
public class FilteredObjectInputStream extends ObjectInputStream {
- private static final List<String> REQUIRED_JAVA_CLASSES = Arrays.asList(
+ private static final Set<String> REQUIRED_JAVA_CLASSES = new HashSet<>(Arrays.asList(
"java.math.BigDecimal",
"java.math.BigInteger",
// for Message delegate
"java.rmi.MarshalledObject",
"[B"
- );
+ ));
- private static final List<String> REQUIRED_JAVA_PACKAGES = Arrays.asList(
+ private static final Set<String> REQUIRED_JAVA_PACKAGES = new HashSet<>(Arrays.asList(
"java.lang.",
- "java.time",
+ "java.time.",
"java.util.",
"org.apache.logging.log4j.",
"[Lorg.apache.logging.log4j."
- );
+ ));
private final Collection<String> allowedExtraClasses;
