Skip to main content
PreparationZone Logo
PreparationZone
Sign up
Back to Java

Java · Hard · Pro

JEP 290 serialization filters — allowlist in production?

JavaModules & SecuritySenior
Model answerPreview

JEP 290 serialization filters

Global and per-stream serialization filters allowlist classes before deserialization—mitigating gadget chains (Commons Collections, etc.) even if an endpoint accepts binary Java…