Class SerializingHttpMessageConverter

java.lang.Object
org.springframework.http.converter.AbstractHttpMessageConverter<Serializable>
org.springframework.integration.http.converter.SerializingHttpMessageConverter
All Implemented Interfaces:
org.springframework.http.converter.HttpMessageConverter<Serializable>
public class SerializingHttpMessageConverter extends org.springframework.http.converter.AbstractHttpMessageConverter<Serializable>
An HttpMessageConverter implementation for Serializable instances.

Incoming requests are deserialized through an AllowListDeserializingConverter. For backward compatibility no class restriction is applied by default; when this converter is used to read requests from untrusted sources, configure an allowlist of trusted classes/packages via setAllowedPatterns(String...) or addAllowedPatterns(String...) to guard against unsafe Java deserialization.

Since:
2.0

  • Field Summary

    Fields inherited from class org.springframework.http.converter.AbstractHttpMessageConverter

    logger

  • Constructor Summary

    Constructors
    Constructor
    Description
    SerializingHttpMessageConverter()
    Creates a new instance of the SerializingHttpMessageConverter.

  • Method Summary

    Modifier and Type
    Method
    Description
    void
    addAllowedPatterns(String... allowedPatterns)
    Add package/class patterns to the allowed list.
    boolean
    canWrite(Class<?> clazz, @Nullable org.springframework.http.MediaType mediaType)
     
    Serializable
    readInternal(Class<? extends Serializable> clazz, org.springframework.http.HttpInputMessage inputMessage)
     
    void
    setAllowedPatterns(String... allowedPatterns)
    Set simple patterns for allowable packages/classes for deserialization.
    boolean
    supports(Class<?> clazz)
     
    protected void
    writeInternal(Serializable object, org.springframework.http.HttpOutputMessage outputMessage)
     

    Methods inherited from class org.springframework.http.converter.AbstractHttpMessageConverter

    addDefaultHeaders, canRead, canRead, canWrite, getContentLength, getDefaultCharset, getDefaultContentType, getSupportedMediaTypes, read, setDefaultCharset, setSupportedMediaTypes, supportsRepeatableWrites, write

    Methods inherited from class Object

    clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

    Methods inherited from interface org.springframework.http.converter.HttpMessageConverter

    getSupportedMediaTypes

  • Constructor Details

    • SerializingHttpMessageConverter

      public SerializingHttpMessageConverter()
      Creates a new instance of the SerializingHttpMessageConverter.

  • Method Details

    • setAllowedPatterns

      public void setAllowedPatterns(String... allowedPatterns)
      Set simple patterns for allowable packages/classes for deserialization. The patterns will be applied in order until a match is found. A class can be fully qualified, or a wildcard '*' is allowed at the beginning or end of the class name. Examples: com.foo.*, *.MyClass. The basic types (String, Number, arrays and primitives) are always allowed. When no patterns are configured, all classes are deserialized (the previous, unrestricted behavior).
      Parameters:
      allowedPatterns - the patterns.
      Since:
      5.5.22

    • addAllowedPatterns

      public void addAllowedPatterns(String... allowedPatterns)
      Add package/class patterns to the allowed list.
      Parameters:
      allowedPatterns - the patterns to add.
      Since:
      5.5.22
      See Also:

    • supports

      public boolean supports(Class<?> clazz)
      Specified by:
      supports in class org.springframework.http.converter.AbstractHttpMessageConverter<Serializable>

    • canWrite

      public boolean canWrite(Class<?> clazz, @Nullable org.springframework.http.MediaType mediaType)
      Specified by:
      canWrite in interface org.springframework.http.converter.HttpMessageConverter<Serializable>
      Overrides:
      canWrite in class org.springframework.http.converter.AbstractHttpMessageConverter<Serializable>

    • readInternal

      public Serializable readInternal(Class<? extends Serializable> clazz, org.springframework.http.HttpInputMessage inputMessage) throws IOException
      Specified by:
      readInternal in class org.springframework.http.converter.AbstractHttpMessageConverter<Serializable>
      Throws:
      IOException

    • writeInternal

      protected void writeInternal(Serializable object, org.springframework.http.HttpOutputMessage outputMessage) throws IOException
      Specified by:
      writeInternal in class org.springframework.http.converter.AbstractHttpMessageConverter<Serializable>
      Throws:
      IOException