Package org.springframework.integration.http.converter

Class SerializingHttpMessageConverter

java.lang.Object

org.springframework.http.converter.AbstractHttpMessageConverter<Serializable>

org.springframework.integration.http.converter.SerializingHttpMessageConverter

All Implemented Interfaces:

HttpMessageConverter<Serializable>

public class SerializingHttpMessageConverter
extends AbstractHttpMessageConverter<Serializable>

An HttpMessageConverter implementation for Serializable instances.

Incoming requests are deserialized through an AllowListDeserializingConverter. By default, only the AllowListDeserializingConverter.DEFAULT_ALLOWED_PATTERNS are allowed. Use addAllowedPatterns(String...) to trust additional classes/packages, or setAllowedPatterns(String...) to replace the defaults.

Since:

2.0

Author:

Mark Fisher, Gary Russell, Artem Bilan, Uwez Khan, Hyun Lee, Glenn Renfro

Field Summary

Fields inherited from class org.springframework.http.converter.AbstractHttpMessageConverter

logger

Constructor Summary

Constructors

Constructor	Description
SerializingHttpMessageConverter()	Create a new instance which allows only the AllowListDeserializingConverter.DEFAULT_ALLOWED_PATTERNS for deserialization.

Method Summary

Modifier and Type	Method	Description
void	addAllowedPatterns(String... allowedPatterns)	Add package/class patterns to the allowed list, in addition to the existing ones (by default the AllowListDeserializingConverter.DEFAULT_ALLOWED_PATTERNS).
boolean	canWrite(Class<?> clazz, @Nullable MediaType mediaType)
Serializable	readInternal(Class<? extends Serializable> clazz, HttpInputMessage inputMessage)
void	setAllowedPatterns(String... allowedPatterns)	Set simple patterns for allowable packages/classes for deserialization.
boolean	supports(Class<?> clazz)
protected void	writeInternal(Serializable object, HttpOutputMessage outputMessage)

Methods inherited from class org.springframework.http.converter.AbstractHttpMessageConverter

addDefaultHeaders, canRead, canRead, canWrite, getContentLength, getDefaultCharset, getDefaultContentType, getSupportedMediaTypes, read, setDefaultCharset, setSupportedMediaTypes, supportsRepeatableWrites, write

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Methods inherited from interface org.springframework.http.converter.HttpMessageConverter

canWriteRepeatedly, getSupportedMediaTypes

Constructor Details

SerializingHttpMessageConverter

public SerializingHttpMessageConverter()

Create a new instance which allows only the AllowListDeserializingConverter.DEFAULT_ALLOWED_PATTERNS for deserialization.

Method Details

setAllowedPatterns

public void setAllowedPatterns(String... allowedPatterns)

Set simple patterns for allowable packages/classes for deserialization. The patterns will be applied in order until a match is found. A class can be fully qualified, or a wildcard '*' is allowed at the beginning or end of the class name. Examples: com.example.*, *.MyClass. The provided patterns replace the existing ones, including the AllowListDeserializingConverter.DEFAULT_ALLOWED_PATTERNS. Primitives, String and arrays of allowed types are always allowed.

Parameters:

allowedPatterns - the patterns.

Since:

5.5.22

addAllowedPatterns

public void addAllowedPatterns(String... allowedPatterns)

Add package/class patterns to the allowed list, in addition to the existing ones (by default the AllowListDeserializingConverter.DEFAULT_ALLOWED_PATTERNS).

Parameters:

allowedPatterns - the patterns to add.

Since:

5.5.22

supports

public boolean supports(Class<?> clazz)

Specified by:

supports in class AbstractHttpMessageConverter<Serializable>

canWrite

public boolean canWrite(Class<?> clazz,
 @Nullable MediaType mediaType)

Specified by:

canWrite in interface HttpMessageConverter<Serializable>

Overrides:

canWrite in class AbstractHttpMessageConverter<Serializable>

readInternal

public Serializable readInternal(Class<? extends Serializable> clazz,
 HttpInputMessage inputMessage)
                          throws IOException

Specified by:

readInternal in class AbstractHttpMessageConverter<Serializable>

Throws:

IOException

writeInternal

protected void writeInternal(Serializable object,
 HttpOutputMessage outputMessage)
                      throws IOException

Specified by:

writeInternal in class AbstractHttpMessageConverter<Serializable>

Throws:

IOException