From 4677ca31f428d9e62a1f1b61dd125f5c5bcdb58f Mon Sep 17 00:00:00 2001 From: mkyong Date: Tue, 28 Sep 2021 19:29:58 +0800 Subject: [PATCH 01/15] Java 17 --- java-17/pom.xml | 38 +++++++++ .../main/java/com/mkyong/java17/HelloApp.java | 9 +++ .../java/com/mkyong/java17/jep356/JEP356.java | 36 +++++++++ .../java/com/mkyong/java17/jep406/JEP406.java | 63 +++++++++++++++ .../com/mkyong/java17/jep406/JEP406_2.java | 49 ++++++++++++ .../com/mkyong/java17/jep415/DdosExample.java | 10 +++ .../java17/jep415/JComponentExample.java | 7 ++ .../java/com/mkyong/java17/jep415/JEP290.java | 49 ++++++++++++ .../com/mkyong/java17/jep415/JEP290_B.java | 48 +++++++++++ .../java/com/mkyong/java17/jep415/JEP415.java | 41 ++++++++++ .../com/mkyong/java17/jep415/JEP415_B.java | 79 +++++++++++++++++++ java-17/src/main/resources/test.html | 5 ++ 12 files changed, 434 insertions(+) create mode 100644 java-17/pom.xml create mode 100644 java-17/src/main/java/com/mkyong/java17/HelloApp.java create mode 100644 java-17/src/main/java/com/mkyong/java17/jep356/JEP356.java create mode 100644 java-17/src/main/java/com/mkyong/java17/jep406/JEP406.java create mode 100644 java-17/src/main/java/com/mkyong/java17/jep406/JEP406_2.java create mode 100644 java-17/src/main/java/com/mkyong/java17/jep415/DdosExample.java create mode 100644 java-17/src/main/java/com/mkyong/java17/jep415/JComponentExample.java create mode 100644 java-17/src/main/java/com/mkyong/java17/jep415/JEP290.java create mode 100644 java-17/src/main/java/com/mkyong/java17/jep415/JEP290_B.java create mode 100644 java-17/src/main/java/com/mkyong/java17/jep415/JEP415.java create mode 100644 java-17/src/main/java/com/mkyong/java17/jep415/JEP415_B.java create mode 100644 java-17/src/main/resources/test.html diff --git a/java-17/pom.xml b/java-17/pom.xml new file mode 100644 index 0000000..0c1c6e0 --- /dev/null +++ b/java-17/pom.xml @@ -0,0 +1,38 @@ + + 4.0.0 + com.mkyong + java17 + 1.0 + + java-17 + https://www.mkyong.com + + + UTF-8 + 17 + 17 + 17 + + + + + + + java17 + + + org.apache.maven.plugins + maven-compiler-plugin + 3.8.1 + + 17 + 17 + --enable-preview + + + + + diff --git a/java-17/src/main/java/com/mkyong/java17/HelloApp.java b/java-17/src/main/java/com/mkyong/java17/HelloApp.java new file mode 100644 index 0000000..35cd61a --- /dev/null +++ b/java-17/src/main/java/com/mkyong/java17/HelloApp.java @@ -0,0 +1,9 @@ +package com.mkyong.java17; + +public class HelloApp { + + public static void main(String[] args) { + System.out.println("Hello Java 17"); + } + +} \ No newline at end of file diff --git a/java-17/src/main/java/com/mkyong/java17/jep356/JEP356.java b/java-17/src/main/java/com/mkyong/java17/jep356/JEP356.java new file mode 100644 index 0000000..3bacb84 --- /dev/null +++ b/java-17/src/main/java/com/mkyong/java17/jep356/JEP356.java @@ -0,0 +1,36 @@ +package com.mkyong.java17.jep356; + +import java.security.Security; +import java.util.random.RandomGenerator; +import java.util.random.RandomGeneratorFactory; + +public class JEP356 { + + public static void main(String[] args) { + + // RandomGeneratorFactory.of("Random").create(42); + + // default L32X64MixRandom + // RandomGenerator randomGenerator = RandomGeneratorFactory.getDefault().create(); + + // Passing the same seed to random, and then calling it will give you the same set of numbers + // seed = 999 + RandomGenerator randomGenerator = RandomGeneratorFactory.of("Xoshiro256PlusPlus").create(999); + + System.out.println(randomGenerator.getClass()); + + int counter = 0; + while(counter<=10){ + // 0-10 + int result = randomGenerator.nextInt(11); + System.out.println(result); + counter++; + } + + RandomGeneratorFactory.all() + .map(fac -> fac.group()+ " : " +fac.name()) + .sorted() + .forEach(System.out::println); + + } +} diff --git a/java-17/src/main/java/com/mkyong/java17/jep406/JEP406.java b/java-17/src/main/java/com/mkyong/java17/jep406/JEP406.java new file mode 100644 index 0000000..804c89e --- /dev/null +++ b/java-17/src/main/java/com/mkyong/java17/jep406/JEP406.java @@ -0,0 +1,63 @@ +package com.mkyong.java17.jep406; + +public class JEP406 { + + public static void main(String[] args) { + + System.out.println(formatterJava17("Java 17")); + System.out.println(formatterJava17(17)); + + testStringJava17("Java 16"); // Ok + testStringJava17("Java 11"); // LTS + testStringJava17(""); // Ok + testStringJava17(null); // Unknown! + } + + // check null, before Java 17 + static void testString(String s) { + if (s == null) { + System.out.println("Unknown!"); + return; + } + switch (s) { + case "Java 11", "Java 17" -> System.out.println("LTS"); + default -> System.out.println("Ok"); + } + } + + // check null, Java 17 + static void testStringJava17(String s) { + switch (s) { + case null -> System.out.println("Unknown!"); + case "Java 11", "Java 17" -> System.out.println("LTS"); + default -> System.out.println("Ok"); + } + } + + // if...else chain, before Java 17 + static String formatter(Object o) { + String formatted = "unknown"; + if (o instanceof Integer i) { + formatted = String.format("int %d", i); + } else if (o instanceof Long l) { + formatted = String.format("long %d", l); + } else if (o instanceof Double d) { + formatted = String.format("double %f", d); + } else if (o instanceof String s) { + formatted = String.format("String %s", s); + } + return formatted; + } + + // if...else chain, Java 17 + static String formatterJava17(Object o) { + return switch (o) { + case Integer i -> String.format("int %d", i); + case Long l -> String.format("long %d", l); + case Double d -> String.format("double %f", d); + case String s -> String.format("String %s", s); + default -> o.toString(); + }; + } + +} diff --git a/java-17/src/main/java/com/mkyong/java17/jep406/JEP406_2.java b/java-17/src/main/java/com/mkyong/java17/jep406/JEP406_2.java new file mode 100644 index 0000000..9d59031 --- /dev/null +++ b/java-17/src/main/java/com/mkyong/java17/jep406/JEP406_2.java @@ -0,0 +1,49 @@ +package com.mkyong.java17.jep406; + +public class JEP406_2 { + + public static void main(String[] args) { + + testTriangle(null); + testTriangle2(null); + + } + + class Shape {} + class Rectangle extends Shape {} + class Triangle extends Shape { + int calculateArea(){ + return 8; + } } + + static void testTriangle(Shape s) { + switch (s) { + case null: + break; + case Triangle t: + if (t.calculateArea() > 100) { + System.out.println("Large triangle"); + break; + }else{ + System.out.println("Triangle"); + } + default: + System.out.println("Unknown!"); + } + } + + static void testTriangle2(Shape s) { + switch (s) { + case null -> + {} + case Triangle t && (t.calculateArea() > 100) -> + System.out.println("Large triangle"); + case Triangle t -> + System.out.println("Triangle"); + default -> + System.out.println("Unknown!"); + } + } + +} + diff --git a/java-17/src/main/java/com/mkyong/java17/jep415/DdosExample.java b/java-17/src/main/java/com/mkyong/java17/jep415/DdosExample.java new file mode 100644 index 0000000..bea1f28 --- /dev/null +++ b/java-17/src/main/java/com/mkyong/java17/jep415/DdosExample.java @@ -0,0 +1,10 @@ +package com.mkyong.java17.jep415; + +import java.io.Serializable; + +public class DdosExample implements Serializable { + @Override + public String toString() { + return "running ddos...!"; + } +} diff --git a/java-17/src/main/java/com/mkyong/java17/jep415/JComponentExample.java b/java-17/src/main/java/com/mkyong/java17/jep415/JComponentExample.java new file mode 100644 index 0000000..da65099 --- /dev/null +++ b/java-17/src/main/java/com/mkyong/java17/jep415/JComponentExample.java @@ -0,0 +1,7 @@ +package com.mkyong.java17.jep415; + +import javax.swing.*; +import java.io.Serializable; + +public class JComponentExample extends JComponent implements Serializable { +} diff --git a/java-17/src/main/java/com/mkyong/java17/jep415/JEP290.java b/java-17/src/main/java/com/mkyong/java17/jep415/JEP290.java new file mode 100644 index 0000000..7a9fa99 --- /dev/null +++ b/java-17/src/main/java/com/mkyong/java17/jep415/JEP290.java @@ -0,0 +1,49 @@ +package com.mkyong.java17.jep415; + +import java.io.*; + +public class JEP290 { + + public static void main(String[] args) throws IOException { + + byte[] bytes = convertObjectToStream(new DdosExample()); + InputStream is = new ByteArrayInputStream(bytes); + ObjectInputStream ois = new ObjectInputStream(is); + + // Setting a Custom Filter Using a Pattern + // need full package path + // the maximum number of bytes in the input stream = 1024 + // allows classes in com.mkyong.java17.jep415.* + // allows classes in the java.base module + // rejects all other classes !* + ObjectInputFilter filter1 = + ObjectInputFilter.Config.createFilter( + "maxbytes=1024;com.mkyong.java17.jep415.*;java.base/*;!*"); + + /* reject com.mkyong.java17.jep415.* + ObjectInputFilter filter1 = + ObjectInputFilter.Config.createFilter( + "maxbytes=1024;!com.mkyong.java17.jep415.*;java.base/*;!*"); + */ + ois.setObjectInputFilter(filter1); + + try { + Object obj = ois.readObject(); + System.out.println("Read obj: " + obj); + } catch (ClassNotFoundException e) { + e.printStackTrace(); + } + } + + private static byte[] convertObjectToStream(Object obj) { + ByteArrayOutputStream boas = new ByteArrayOutputStream(); + try (ObjectOutputStream ois = new ObjectOutputStream(boas)) { + ois.writeObject(obj); + return boas.toByteArray(); + } catch (IOException ioe) { + ioe.printStackTrace(); + } + throw new RuntimeException(); + } + +} diff --git a/java-17/src/main/java/com/mkyong/java17/jep415/JEP290_B.java b/java-17/src/main/java/com/mkyong/java17/jep415/JEP290_B.java new file mode 100644 index 0000000..5e7edb9 --- /dev/null +++ b/java-17/src/main/java/com/mkyong/java17/jep415/JEP290_B.java @@ -0,0 +1,48 @@ +package com.mkyong.java17.jep415; + +import javax.swing.*; +import java.io.*; + +public class JEP290_B { + + public static void main(String[] args) throws IOException { + + byte[] bytes = convertObjectToStream(new JComponentExample()); + InputStream is = new ByteArrayInputStream(bytes); + ObjectInputStream ois = new ObjectInputStream(is); + + ois.setObjectInputFilter(createObjectFilter()); + + try { + Object obj = ois.readObject(); + System.out.println("Read obj: " + obj); + } catch (ClassNotFoundException e) { + e.printStackTrace(); + } + } + + // reject all JComponent classes + private static ObjectInputFilter createObjectFilter() { + return filterInfo -> { + Class clazz = filterInfo.serialClass(); + if (clazz != null) { + return (JComponent.class.isAssignableFrom(clazz)) + ? ObjectInputFilter.Status.REJECTED + : ObjectInputFilter.Status.ALLOWED; + } + return ObjectInputFilter.Status.UNDECIDED; + }; + } + + private static byte[] convertObjectToStream(Object obj) { + ByteArrayOutputStream boas = new ByteArrayOutputStream(); + try (ObjectOutputStream ois = new ObjectOutputStream(boas)) { + ois.writeObject(obj); + return boas.toByteArray(); + } catch (IOException ioe) { + ioe.printStackTrace(); + } + throw new RuntimeException(); + } + +} diff --git a/java-17/src/main/java/com/mkyong/java17/jep415/JEP415.java b/java-17/src/main/java/com/mkyong/java17/jep415/JEP415.java new file mode 100644 index 0000000..e00db1c --- /dev/null +++ b/java-17/src/main/java/com/mkyong/java17/jep415/JEP415.java @@ -0,0 +1,41 @@ +package com.mkyong.java17.jep415; + +import javax.swing.*; +import java.io.*; + +public class JEP415 { + + public static void main(String[] args) throws IOException { + + byte[] bytes = convertObjectToStream(new JComponentExample()); + InputStream is = new ByteArrayInputStream(bytes); + ObjectInputStream ois = new ObjectInputStream(is); + + // Java 17 + // reject all JComponent classes + ObjectInputFilter jComponentFilter = ObjectInputFilter.rejectFilter( + JComponent.class::isAssignableFrom, + ObjectInputFilter.Status.UNDECIDED); + ois.setObjectInputFilter(jComponentFilter); + + try { + Object obj = ois.readObject(); + System.out.println("Read obj: " + obj); + } catch (ClassNotFoundException e) { + e.printStackTrace(); + } + + } + + private static byte[] convertObjectToStream(Object obj) { + ByteArrayOutputStream boas = new ByteArrayOutputStream(); + try (ObjectOutputStream ois = new ObjectOutputStream(boas)) { + ois.writeObject(obj); + return boas.toByteArray(); + } catch (IOException ioe) { + ioe.printStackTrace(); + } + throw new RuntimeException(); + } + +} diff --git a/java-17/src/main/java/com/mkyong/java17/jep415/JEP415_B.java b/java-17/src/main/java/com/mkyong/java17/jep415/JEP415_B.java new file mode 100644 index 0000000..5fdff7d --- /dev/null +++ b/java-17/src/main/java/com/mkyong/java17/jep415/JEP415_B.java @@ -0,0 +1,79 @@ +package com.mkyong.java17.jep415; + +import java.io.*; +import java.util.function.BinaryOperator; + +public class JEP415_B { + + static class PrintFilterFactory implements BinaryOperator { + + @Override + public ObjectInputFilter apply( + ObjectInputFilter currentFilter, ObjectInputFilter nextFilter) { + + System.out.println("Current filter: " + currentFilter); + System.out.println("Requested filter: " + nextFilter); + + // Returns a filter that merges the status of a filter and another filter + return ObjectInputFilter.merge(nextFilter, currentFilter); + + // some logic and return other filters + // reject all JComponent classes + /*return filterInfo -> { + Class clazz = filterInfo.serialClass(); + if (clazz != null) { + if(JComponent.class.isAssignableFrom(clazz)){ + return ObjectInputFilter.Status.REJECTED; + } + } + return ObjectInputFilter.Status.ALLOWED; + };*/ + + } + } + + public static void main(String[] args) throws IOException { + + // Set a filter factory + PrintFilterFactory filterFactory = new PrintFilterFactory(); + ObjectInputFilter.Config.setSerialFilterFactory(filterFactory); + + // create a maxdepth and package filter + ObjectInputFilter filter1 = + ObjectInputFilter.Config.createFilter("com.mkyong.java17.jep415.*;java.base/*;!*"); + ObjectInputFilter.Config.setSerialFilter(filter1); + + // Create a filter to allow String.class only + ObjectInputFilter intFilter = ObjectInputFilter.allowFilter( + cl -> cl.equals(String.class), ObjectInputFilter.Status.REJECTED); + + // if pass anything other than String.class, hits filter status: REJECTED + //byte[] byteStream =convertObjectToStream(99); + + // Create input stream + byte[] byteStream =convertObjectToStream("hello"); + InputStream is = new ByteArrayInputStream(byteStream); + ObjectInputStream ois = new ObjectInputStream(is); + + ois.setObjectInputFilter(intFilter); + + try { + Object obj = ois.readObject(); + System.out.println("Read obj: " + obj); + } catch (ClassNotFoundException e) { + e.printStackTrace(); + } + } + + private static byte[] convertObjectToStream(Object obj) { + ByteArrayOutputStream boas = new ByteArrayOutputStream(); + try (ObjectOutputStream ois = new ObjectOutputStream(boas)) { + ois.writeObject(obj); + return boas.toByteArray(); + } catch (IOException ioe) { + ioe.printStackTrace(); + } + throw new RuntimeException(); + } + +} \ No newline at end of file diff --git a/java-17/src/main/resources/test.html b/java-17/src/main/resources/test.html new file mode 100644 index 0000000..67ef16d --- /dev/null +++ b/java-17/src/main/resources/test.html @@ -0,0 +1,5 @@ + + +

Hello, World

+ + \ No newline at end of file From 00236434b5e000a1d59349c2eddf6e1d3908479d Mon Sep 17 00:00:00 2001 From: mkyong Date: Tue, 5 Oct 2021 16:31:20 +0800 Subject: [PATCH 02/15] java serialization filter --- .../mkyong/io/object/HelloSerialization.java | 42 ++++++ ...Utils.java => HelloSerializationFile.java} | 32 ++--- .../java/com/mkyong/io/object/Person.java | 1 + .../mkyong/io/object/SerializationUtils.java | 122 ++++++++++++++++++ .../mkyong/io/object/attack/DosExample.java | 79 ++++++++++++ .../object/attack/StackOverflowExample.java | 75 +++++++++++ .../serialization/DeserializationBomb.java | 38 ------ .../io/object/serialization/TestExample.java | 24 ---- .../com/mkyong/io/utils/SerializeUtil.java | 26 ---- 9 files changed, 336 insertions(+), 103 deletions(-) create mode 100644 java-io/src/main/java/com/mkyong/io/object/HelloSerialization.java rename java-io/src/main/java/com/mkyong/io/object/{ObjectUtils.java => HelloSerializationFile.java} (60%) create mode 100644 java-io/src/main/java/com/mkyong/io/object/SerializationUtils.java create mode 100644 java-io/src/main/java/com/mkyong/io/object/attack/DosExample.java create mode 100644 java-io/src/main/java/com/mkyong/io/object/attack/StackOverflowExample.java delete mode 100644 java-io/src/main/java/com/mkyong/io/object/serialization/DeserializationBomb.java delete mode 100644 java-io/src/main/java/com/mkyong/io/object/serialization/TestExample.java delete mode 100644 java-io/src/main/java/com/mkyong/io/utils/SerializeUtil.java diff --git a/java-io/src/main/java/com/mkyong/io/object/HelloSerialization.java b/java-io/src/main/java/com/mkyong/io/object/HelloSerialization.java new file mode 100644 index 0000000..1267af5 --- /dev/null +++ b/java-io/src/main/java/com/mkyong/io/object/HelloSerialization.java @@ -0,0 +1,42 @@ +package com.mkyong.io.object; + +import java.io.*; +import java.math.BigDecimal; + +public class HelloSerialization { + + public static void main(String[] args) { + + Person person = new Person("mkyong", 40, new BigDecimal(900)); + + byte[] bytes = convertObjectToBytes(person); + + Person p = (Person) convertBytesToObject(bytes); + + System.out.println(p); + } + + // Convert object to byte[] + public static byte[] convertObjectToBytes(Object obj) { + ByteArrayOutputStream boas = new ByteArrayOutputStream(); + try (ObjectOutputStream ois = new ObjectOutputStream(boas)) { + ois.writeObject(obj); + return boas.toByteArray(); + } catch (IOException ioe) { + ioe.printStackTrace(); + } + throw new RuntimeException(); + } + + // Convert byte[] to object + public static Object convertBytesToObject(byte[] bytes) { + InputStream is = new ByteArrayInputStream(bytes); + try (ObjectInputStream ois = new ObjectInputStream(is)) { + return ois.readObject(); + } catch (IOException | ClassNotFoundException ioe) { + ioe.printStackTrace(); + } + throw new RuntimeException(); + } + +} diff --git a/java-io/src/main/java/com/mkyong/io/object/ObjectUtils.java b/java-io/src/main/java/com/mkyong/io/object/HelloSerializationFile.java similarity index 60% rename from java-io/src/main/java/com/mkyong/io/object/ObjectUtils.java rename to java-io/src/main/java/com/mkyong/io/object/HelloSerializationFile.java index cff245e..6f00f12 100644 --- a/java-io/src/main/java/com/mkyong/io/object/ObjectUtils.java +++ b/java-io/src/main/java/com/mkyong/io/object/HelloSerializationFile.java @@ -3,11 +3,25 @@ import java.io.*; import java.math.BigDecimal; -public class ObjectUtils { +public class HelloSerializationFile { + + public static void main(String[] args) throws IOException, ClassNotFoundException { + + Person person = new Person("mkyong", 50, new BigDecimal(1000)); + + File file = new File("person.anything"); + + writeObjectToFile(person, file); + + Person p = readObjectFromFile(file); + + System.out.println(p); + + } // Serialization // Save object into a file. - public static void writeObject(Person obj, File file) throws IOException { + public static void writeObjectToFile(Person obj, File file) throws IOException { try (FileOutputStream fos = new FileOutputStream(file); ObjectOutputStream oos = new ObjectOutputStream(fos)) { oos.writeObject(obj); @@ -17,7 +31,7 @@ public static void writeObject(Person obj, File file) throws IOException { // Deserialization // Get object from a file. - public static Person readObject(File file) throws IOException, ClassNotFoundException { + public static Person readObjectFromFile(File file) throws IOException, ClassNotFoundException { Person result = null; try (FileInputStream fis = new FileInputStream(file); ObjectInputStream ois = new ObjectInputStream(fis)) { @@ -26,16 +40,4 @@ public static Person readObject(File file) throws IOException, ClassNotFoundExce return result; } - public static void main(String[] args) throws IOException, ClassNotFoundException { - - Person person = new Person("mkyong", 40, new BigDecimal(900)); - - // object -> file - ObjectUtils.writeObject(person, new File("person.obj")); - - // file -> object - Person obj = ObjectUtils.readObject(new File("person.obj")); - System.out.println(obj); - - } } diff --git a/java-io/src/main/java/com/mkyong/io/object/Person.java b/java-io/src/main/java/com/mkyong/io/object/Person.java index 0a66853..d085565 100644 --- a/java-io/src/main/java/com/mkyong/io/object/Person.java +++ b/java-io/src/main/java/com/mkyong/io/object/Person.java @@ -11,6 +11,7 @@ public class Person implements Serializable { private String name; private int age; + // dun save this field into file private transient BigDecimal salary; diff --git a/java-io/src/main/java/com/mkyong/io/object/SerializationUtils.java b/java-io/src/main/java/com/mkyong/io/object/SerializationUtils.java new file mode 100644 index 0000000..f2db1fd --- /dev/null +++ b/java-io/src/main/java/com/mkyong/io/object/SerializationUtils.java @@ -0,0 +1,122 @@ +package com.mkyong.io.object; + +import java.io.*; +import java.math.BigDecimal; +import java.nio.file.Files; +import java.nio.file.Paths; + +public class SerializationUtils { + + // Serialization + // Save object into a file. + public static void writeObjectToFile(Person obj, File file) throws IOException { + try (FileOutputStream fos = new FileOutputStream(file); + ObjectOutputStream oos = new ObjectOutputStream(fos)) { + oos.writeObject(obj); + oos.flush(); + } + } + + // Serialization + // Convert object to OutputStream + public static void writeObjectToStream(Object obj, OutputStream output) throws IOException { + try (ObjectOutputStream oos = new ObjectOutputStream(output)) { + oos.writeObject(obj); + oos.flush(); + } + } + + // Serialization + // Convert object to byte[] + public static byte[] writeObjectToStream(Object obj) { + ByteArrayOutputStream boas = new ByteArrayOutputStream(); + try (ObjectOutputStream ois = new ObjectOutputStream(boas)) { + ois.writeObject(obj); + return boas.toByteArray(); + } catch (IOException ioe) { + ioe.printStackTrace(); + } + throw new RuntimeException(); + } + + // Deserialization + // Get object from a file. + public static Person readObject(File file) throws IOException, ClassNotFoundException { + Person result = null; + try (FileInputStream fis = new FileInputStream(file); + ObjectInputStream ois = new ObjectInputStream(fis)) { + result = (Person) ois.readObject(); + } + return result; + } + + // Deserialization + // generic example + @SuppressWarnings("unchecked") + public static T readObject(InputStream is, Class anyClass) throws IOException, ClassNotFoundException { + T result = null; + try (ObjectInputStream ois = new ObjectInputStream(is)) { + result = (T) ois.readObject(); + } + return result; + } + + public static byte[] serialize(Object o) { + ByteArrayOutputStream ba = new ByteArrayOutputStream(); + try { + new ObjectOutputStream(ba).writeObject(o); + } catch (IOException e) { + throw new IllegalArgumentException(e); + } + return ba.toByteArray(); + } + + public static Object deserialize(byte[] bytes) { + try { + return new ObjectInputStream( + new ByteArrayInputStream(bytes)).readObject(); + } catch (IOException | ClassNotFoundException e) { + throw new IllegalArgumentException(e); + } + } + + public static Object deserializeFilter(byte[] bytes, ObjectInputFilter filter) { + + try (ByteArrayInputStream bais = new ByteArrayInputStream(bytes); + ObjectInputStream ois = new ObjectInputStream(bais)) { + + ois.setObjectInputFilter(filter); + + return ois.readObject(); + }catch (IOException | ClassNotFoundException e) { + throw new IllegalArgumentException(e); + } + + } + + public static void main(String[] args) throws IOException, ClassNotFoundException { + + Person person = new Person("mkyong", 41, new BigDecimal(900)); + + // object -> file + + // example 1 + // SerializationUtils.writeObjectToFile(person, new File("person.obj")); + + // example 2 + SerializationUtils.writeObjectToStream(person, new FileOutputStream("person.obj")); + + // example 3 + // byte[] bytes = SerializationUtils.writeObjectToStream(person); + // Files.write(Paths.get("person.obj"), bytes); + + // file -> object + //Person obj = SerializationUtils.readObject(new File("person.obj")); + + Person obj = SerializationUtils.readObject( + new FileInputStream("person.obj"), Person.class); + + System.out.println(obj); + + } +} diff --git a/java-io/src/main/java/com/mkyong/io/object/attack/DosExample.java b/java-io/src/main/java/com/mkyong/io/object/attack/DosExample.java new file mode 100644 index 0000000..5057390 --- /dev/null +++ b/java-io/src/main/java/com/mkyong/io/object/attack/DosExample.java @@ -0,0 +1,79 @@ +package com.mkyong.io.object.attack; + +import java.io.*; +import java.util.HashSet; +import java.util.Set; + +//https://homepages.ecs.vuw.ac.nz/~alex/files/DietrichJezekRasheedTahirPotaninECOOP2017.pdf +public class DosExample { + + public static void main(String[] args) throws Exception { + System.out.println(bomb().length); + + //deserialize(bomb()); // Dos here + + ObjectInputFilter filter = + ObjectInputFilter.Config.createFilter( + "maxdepth=10;java.base/*;!*"); + + deserializeFilter(bomb(), filter); // Dos here + + System.out.println("Done"); + } + + static byte[] bomb() { + Set