Deserialization filters
Restrict which classes can be deserialized to prevent attacks.
Code Comparison
✕ Java 8
// Dangerous: accepts any class
ObjectInputStream ois =
new ObjectInputStream(input);
Object obj = ois.readObject();
// deserialization attacks possible!
✓ Java 9+
ObjectInputFilter filter =
ObjectInputFilter.Config
.createFilter(
"com.myapp.*;!*"
);
ois.setObjectInputFilter(filter);
Object obj = ois.readObject();
Why the modern way wins
Security
Prevent deserialization of unexpected/malicious classes.
Fine-grained
Control depth, array size, references, and class patterns.
JVM-wide
Set a global filter for all deserialization in the JVM.
Old Approach
Accept Everything
Modern Approach
ObjectInputFilter
Since JDK
9
Difficulty
advanced
JDK Support
Deserialization filters
Available
Widely available since JDK 9 (Sept 2017)
How it works
ObjectInputFilter lets you allowlist/denylist classes, limit object graph depth, array sizes, and reference counts. This defends against deserialization vulnerabilities without external libraries.