Package hudson.remoting

Class ClassFilter

java.lang.Object
hudson.remoting.ClassFilter
public abstract class ClassFilter extends Object
Restricts what classes can be received through remoting. The same filter is also applied by Jenkins core for XStream serialization.
Since:
2.53
Author:
Kohsuke Kawaguchi

  • Field Details

    • FILE_OVERRIDE_LOCATION_PROPERTY

      @Deprecated public static final String FILE_OVERRIDE_LOCATION_PROPERTY
      Deprecated.
      use setDefault(hudson.remoting.ClassFilter) as needed
      Property to set to override the blacklist used by STANDARD with a different set. The location should point to a a file containing regular expressions (one per line) of classes to blacklist. If this property is set but the file can not be read the default blacklist will be used.
      Since:
      2.53.2
      See Also:

    • DEFAULT

      public static final ClassFilter DEFAULT
      The currently used default. Defaults to STANDARD.

    • STANDARD

      public static final ClassFilter STANDARD
      A set of sensible default filtering rules to apply, based on a configurable blacklist.

    • NONE

      public static final ClassFilter NONE
      No filtering whatsoever.

  • Constructor Details

    • ClassFilter

      public ClassFilter()

  • Method Details

    • isBlacklisted

      public boolean isBlacklisted(@NonNull String name)
      Whether a given class should be blocked, before even attempting to load that class.
      Parameters:
      name - Class.getName()
      Returns:
      false by default; override to return true to blacklist this class

    • isBlacklisted

      public boolean isBlacklisted(@NonNull Class<?> c)
      Whether a given class should be blocked, after having loaded that class.
      Parameters:
      c - a loaded class
      Returns:
      false by default; override to return true to blacklist this class

    • check

      public final String check(String name)
      API version of isBlacklisted(String) SPI.
      Returns:
      the same name
      Throws:
      SecurityException - if it is blacklisted

    • check

      public final Class<?> check(Class<?> c)
      API version of isBlacklisted(Class) SPI.
      Returns:
      the same c
      Throws:
      SecurityException - if it is blacklisted

    • setDefault

      public static void setDefault(@NonNull ClassFilter filter)
      Changes the effective value of DEFAULT.
      Parameters:
      filter - a new default to set; may or may not delegate to STANDARD
      Since:
      3.16

    • appendDefaultFilter

      @Deprecated public static void appendDefaultFilter(Pattern filter) throws ClassFilter.ClassFilterException
      Deprecated.
      use setDefault(hudson.remoting.ClassFilter) as needed
      Adds an additional exclusion to STANDARD. Does nothing if the default list has already been customized via FILE_OVERRIDE_LOCATION_PROPERTY. This API is not supposed to be used anywhere outside Jenkins core, calls for other sources may be rejected later.
      Parameters:
      filter - a regular expression for Class.getName() which, if matched according to Matcher.matches(), will blacklist the class
      Throws:
      ClassFilter.ClassFilterException - Filter pattern cannot be applied. It means either unexpected processing error or rejection by the internal logic.
      Since:
      3.11