Name
SerializablePermission
Synopsis
This
class is a
java.security.Permission
that governs the use of
certain sensitive features of serialization.
SerializablePermission
objects have a name, or
target, but do not have an action list. The name
“enableSubclassImplementation”
represents permission to serialize and deserialize objects using
subclasses of ObjectOutputStream
and
ObjectInputStream
. This capability is protected by
a permission because malicious code can define object stream
subclasses that incorrectly serialize and deserialize objects.
The only other name supported by
SerializablePermission
is
“enableSubstitution,” which
represents permission for one object to be substituted for another
during serialization or deserialization. Permission of this type is
required by the ObjectOutputStream.enableReplaceObject(
)
and ObjectInputStream.enableResolveObject(
)
methods.
Applications never need to use this class. Programmers writing system-level code may use it, and system administrators configuring security policies should be familiar with it.
Figure 9-56. java.io.SerializablePermission
public final class SerializablePermission extends java.security.BasicPermission { // Public Constructors public SerializablePermission(String name); public SerializablePermission(String name, String actions); }
Type Of
ObjectStreamConstants.{SUBCLASS_IMPLEMENTATION_PERMISSION
,
SUBSTITUTION_PERMISSION} ...
Get Java in a Nutshell, 5th Edition now with the O’Reilly learning platform.
O’Reilly members experience books, live events, courses curated by job role, and more from O’Reilly and nearly 200 top publishers.