Package org.apache.avro.util

# Class ClassSecurityValidator

java.lang.Object
org.apache.avro.util.ClassSecurityValidator

public final class ClassSecurityValidator extends Object
Validates that a class is trusted to be included in Avro schemas. To be used by `ClassUtils` which therefore automatically guards not only the loading of the classes but, since the class names are translated into `Class` objects by using `ClassUtils`, also guards any other reflection-based mechanisms (e.g. instantiation, setting internal variables).

See Also:
  - `setGlobal(ClassSecurityPredicate)`
  - `getGlobal()`

## Nested Class Summary

Nested Classes
Modifier and Type
Class
Description
`static class`
`ClassSecurityValidator.Builder`
`static interface`
`ClassSecurityValidator.ClassSecurityPredicate`
A predicate that checks if a class is trusted to be included in Avro schemas.
`static class`
`ClassSecurityValidator.SystemPropertiesPredicate`

## Field Summary

Fields
Modifier and Type
Field
Description
`static final ClassSecurityValidator.ClassSecurityPredicate`
`DEFAULT`
The default predicate that uses both the system properties and the hard-coded trusted classes.
`static final ClassSecurityValidator.ClassSecurityPredicate`
`DEFAULT_TRUSTED_CLASSES`
A couple of trusted classes that are safe to be loaded, instantiated with any constructors or alter any internals via reflection.
`static final ClassSecurityValidator.ClassSecurityPredicate`
`SYSTEM_PROPERTIES`
The predicate that uses the system properties "org.apache.avro.SERIALIZABLE_CLASSES" and "org.apache.avro.SERIALIZABLE_PACKAGES".

## Method Summary

Modifier and Type
Method
Description
`static ClassSecurityValidator.Builder`
`builder()`
Creates a builder for a `ClassSecurityValidator` that validates the trusted classes by whitelisting their names.
`static ClassSecurityValidator.ClassSecurityPredicate`
`composite(ClassSecurityValidator.ClassSecurityPredicate... validators)`
Creates a composite `ClassSecurityValidator` that delegates to the given validators.
`static ClassSecurityValidator.ClassSecurityPredicate`
`getGlobal()`
Returns the global `ClassSecurityValidator.ClassSecurityPredicate` that is used by `ClassUtils` to validate the trusted classes.
`static void`
`setGlobal(ClassSecurityValidator.ClassSecurityPredicate validator)`
Sets the global `ClassSecurityValidator.ClassSecurityPredicate` that is used by `ClassUtils` to validate the trusted classes.
`static void`
`validate(Class<?> clazz)`
Validates that the class is trusted to be included in Avro schemas.

### Methods inherited from class java.lang.Object

`clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait`

## Field Details

### DEFAULT_TRUSTED_CLASSES

public static final ClassSecurityValidator.ClassSecurityPredicate DEFAULT_TRUSTED_CLASSES
A couple of trusted classes that are safe to be loaded, instantiated with any constructors or alter any internals via reflection.

### SYSTEM_PROPERTIES

public static final ClassSecurityValidator.ClassSecurityPredicate SYSTEM_PROPERTIES
The predicate that uses the system properties "org.apache.avro.SERIALIZABLE_CLASSES" and "org.apache.avro.SERIALIZABLE_PACKAGES".

### DEFAULT

public static final ClassSecurityValidator.ClassSecurityPredicate DEFAULT
The default predicate that uses both the system properties and the hard-coded trusted classes.

See Also:
  - `DEFAULT_TRUSTED_CLASSES`
  - `SYSTEM_PROPERTIES`

## Method Details

### validate

public static void validate(Class<?> clazz)
Validates that the class is trusted to be included in Avro schemas.

Note: this method shall be invoked with un-initialized classes only to prevent any potential security issues the initialization may trigger.

Parameters:
  `clazz` - the class to validate
Throws:
  `SecurityException` - if the class is not trusted

### setGlobal

public static void setGlobal(ClassSecurityValidator.ClassSecurityPredicate validator)
Sets the global `ClassSecurityValidator.ClassSecurityPredicate` that is used by `ClassUtils` to validate the trusted classes.

Parameters:
  `validator` - the validator to use

### getGlobal

public static ClassSecurityValidator.ClassSecurityPredicate getGlobal()
Returns the global `ClassSecurityValidator.ClassSecurityPredicate` that is used by `ClassUtils` to validate the trusted classes.

Returns:
  the global validator

### builder

public static ClassSecurityValidator.Builder builder()
Creates a builder for a `ClassSecurityValidator` that validates the trusted classes by whitelisting their names. Note: no parent validator is used.

Returns:
  a new `ClassSecurityValidator` builder

### composite

public static ClassSecurityValidator.ClassSecurityPredicate composite(ClassSecurityValidator.ClassSecurityPredicate... validators)
Creates a composite `ClassSecurityValidator` that delegates to the given validators.

Parameters:
  `validators` - the validators to delegate to
Returns:
  a new `ClassSecurityValidator` that delegates to the given validators