Package hudson.remoting

Class ClassFilter

java.lang.Object

hudson.remoting.ClassFilter

public abstract class ClassFilter
extends Object

Restricts what classes can be received through remoting. The same filter is also applied by Jenkins core for XStream serialization.

Since:

2.53

Author:

Kohsuke Kawaguchi

Nested Class Summary

Nested Classes

Modifier and Type	Class	Description
static class	ClassFilter.ClassFilterException	Deprecated. Only used by deprecated appendDefaultFilter(java.util.regex.Pattern).

Field Summary

Fields

Modifier and Type	Field	Description
static ClassFilter	DEFAULT	The currently used default.
static String	FILE_OVERRIDE_LOCATION_PROPERTY	Deprecated. use setDefault(hudson.remoting.ClassFilter) as needed
static ClassFilter	NONE	No filtering whatsoever.
static ClassFilter	STANDARD	A set of sensible default filtering rules to apply, based on a configurable blacklist.

Constructor Summary

Constructors

Constructor	Description
ClassFilter()

Method Summary

Modifier and Type	Method	Description
static void	appendDefaultFilter(Pattern filter)	Deprecated. use setDefault(hudson.remoting.ClassFilter) as needed
Class<?>	check(Class<?> c)	API version of isBlacklisted(Class) SPI.
String	check(String name)	API version of isBlacklisted(String) SPI.
boolean	isBlacklisted(Class<?> c)	Whether a given class should be blocked, after having loaded that class.
boolean	isBlacklisted(String name)	Whether a given class should be blocked, before even attempting to load that class.
static void	setDefault(ClassFilter filter)	Changes the effective value of DEFAULT.

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Field Detail

FILE_OVERRIDE_LOCATION_PROPERTY

@Deprecated
public static final String FILE_OVERRIDE_LOCATION_PROPERTY

Deprecated.

use setDefault(hudson.remoting.ClassFilter) as needed

Property to set to override the blacklist used by STANDARD with a different set. The location should point to a a file containing regular expressions (one per line) of classes to blacklist. If this property is set but the file can not be read the default blacklist will be used.

Since:

2.53.2

See Also:

Constant Field Values

DEFAULT

public static final ClassFilter DEFAULT

The currently used default. Defaults to STANDARD.

STANDARD

public static final ClassFilter STANDARD

A set of sensible default filtering rules to apply, based on a configurable blacklist.

NONE

public static final ClassFilter NONE

No filtering whatsoever.

Constructor Detail

ClassFilter

public ClassFilter()

Method Detail

isBlacklisted

public boolean isBlacklisted(@NonNull
                             String name)

Whether a given class should be blocked, before even attempting to load that class.

Parameters:

name - Class.getName()

Returns:

false by default; override to return true to blacklist this class

isBlacklisted

public boolean isBlacklisted(@NonNull
                             Class<?> c)

Whether a given class should be blocked, after having loaded that class.

Parameters:

c - a loaded class

Returns:

false by default; override to return true to blacklist this class

check

public final String check(String name)

API version of isBlacklisted(String) SPI.

Returns:

the same name

Throws:

SecurityException - if it is blacklisted

check

public final Class<?> check(Class<?> c)

API version of isBlacklisted(Class) SPI.

Returns:

the same c

Throws:

SecurityException - if it is blacklisted

setDefault

public static void setDefault(@NonNull
                              ClassFilter filter)

Changes the effective value of DEFAULT.

Parameters:

filter - a new default to set; may or may not delegate to STANDARD

Since:

3.16

appendDefaultFilter

@Deprecated
public static void appendDefaultFilter(Pattern filter)
                                throws ClassFilter.ClassFilterException

Deprecated.

use setDefault(hudson.remoting.ClassFilter) as needed

Adds an additional exclusion to STANDARD. Does nothing if the default list has already been customized via FILE_OVERRIDE_LOCATION_PROPERTY. This API is not supposed to be used anywhere outside Jenkins core, calls for other sources may be rejected later.

Parameters:

filter - a regular expression for Class.getName() which, if matched according to Matcher.matches(), will blacklist the class

Throws:

ClassFilter.ClassFilterException - Filter pattern cannot be applied. It means either unexpected processing error or rejection by the internal logic.

Since:

3.11