Spring/spring-integration
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Fix deprecations from SF

Browse Source 
* Remove `whitelist` words
* Resolve Sonar smells
* Add `await()` for FTP file removal test: looks like this operation may fail under the stress build
This commit is contained in:
Artem Bilan
2020-06-19 12:07:58 -04:00
parent 3a9ae217b8
commit 498f42d480
15 changed files with 58 additions and 232 deletions
Download Patch File Download Diff File Expand all files Collapse all files

6
spring-integration-core/src/main/java/org/springframework/integration/config/xml/PayloadDeserializingTransformerParser.java
View File

@@ -39,12 +39,6 @@ public class PayloadDeserializingTransformerParser extends AbstractTransformerPa
@Override
protected void parseTransformer(Element element, ParserContext parserContext, BeanDefinitionBuilder builder) {
IntegrationNamespaceUtils.setReferenceIfAttributeDefined(builder, element, "deserializer");
// TODO remove in 5.5
if (element.hasAttribute("white-list")) {
parserContext.getReaderContext().error(
"the 'white-list' attribute is deprecated in favor of 'allow-list'", element);
}
IntegrationNamespaceUtils.setValueIfAttributeDefined(builder, element, "white-list", "allowedPatterns");
IntegrationNamespaceUtils.setValueIfAttributeDefined(builder, element, "allow-list", "allowedPatterns");
}

94
spring-integration-core/src/main/java/org/springframework/integration/support/converter/WhiteListDeserializingConverter.java
View File

@@ -1,94 +0,0 @@
/*
* Copyright 2002-2020 the original author or authors.
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
* You may obtain a copy of the License at
*
* https://www.apache.org/licenses/LICENSE-2.0
*
* Unless required by applicable law or agreed to in writing, software
* distributed under the License is distributed on an "AS IS" BASIS,
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
* See the License for the specific language governing permissions and
* limitations under the License.
*/
package org.springframework.integration.support.converter;
import org.springframework.core.convert.converter.Converter;
import org.springframework.core.serializer.DefaultDeserializer;
import org.springframework.core.serializer.Deserializer;
/**
* A {@link Converter} that delegates to a
* {@link org.springframework.core.serializer.Deserializer} to convert data in a byte
* array to an object. By default, if using a {@link DefaultDeserializer} all
* classes/packages are deserialized. If you receive data from untrusted sources, consider
* adding trusted classes/packages using {@link #setWhiteListPatterns(String...)} or
* {@link #addWhiteListPatterns(String...)}.
*
* @author Gary Russell
* @author Mark Fisher
* @author Juergen Hoeller
*
* @since 4.2.13
*
* @deprecated since 5.4 in favor of AllowListDeserializingConverter
*/
@Deprecated
public class WhiteListDeserializingConverter extends AllowListDeserializingConverter {
/**
* Create a {@code WhiteListDeserializingConverter} with default
* {@link java.io.ObjectInputStream} configuration, using the "latest user-defined
* ClassLoader".
*/
public WhiteListDeserializingConverter() {
super();
}
/**
* Create a {@code WhiteListDeserializingConverter} for using an
* {@link java.io.ObjectInputStream} with the given {@code ClassLoader}.
* @param classLoader the class loader to use for deserialization.
*/
public WhiteListDeserializingConverter(ClassLoader classLoader) {
super(classLoader);
}
/**
* Create a {@code WhiteListDeserializingConverter} that delegates to the provided
* {@link Deserializer}.
* @param deserializer the deserializer to use.
*/
public WhiteListDeserializingConverter(Deserializer<Object> deserializer) {
super(deserializer);
}
/**
* Set simple patterns for allowable packages/classes for deserialization.
* The patterns will be applied in order until a match is found.
* A class can be fully qualified or a wildcard '*' is allowed at the
* beginning or end of the class name.
* Examples: {@code com.foo.*}, {@code *.MyClass}.
* @param whiteListPatterns the patterns.
*/
public void setWhiteListPatterns(String... whiteListPatterns) {
setAllowedPatterns(whiteListPatterns);
}
/**
* Add package/class patterns to the white list.
* @param patterns the patterns to add.
* @see #setWhiteListPatterns(String...)
*/
public void addWhiteListPatterns(String... patterns) {
addAllowedPatterns(patterns);
}
protected void checkWhiteList(Class<?> clazz) {
checkAllowList(clazz);
}
}

8
spring-integration-core/src/main/java/org/springframework/integration/support/json/JacksonJsonUtils.java
View File

@@ -140,7 +140,7 @@ public final class JacksonJsonUtils {
/**
* A {@link TypeIdResolver} that delegates to an existing implementation
* and throws an IllegalStateException if the class being looked up is not whitelisted,
* and throws an IllegalStateException if the class being looked up is not trusted,
* does not provide an explicit mixin mappings.
*
* @author Rob Winch
@@ -167,13 +167,13 @@ public final class JacksonJsonUtils {
AllowlistTypeIdResolver(TypeIdResolver delegate, String... trustedPackages) {
this.delegate = delegate;
if (trustedPackages != null) {
for (String whiteListPackage : trustedPackages) {
if ("*".equals(whiteListPackage)) {
for (String trustedPackage : trustedPackages) {
if ("*".equals(trustedPackage)) {
this.trustedPackages.clear();
break;
}
else {
this.trustedPackages.add(whiteListPackage);
this.trustedPackages.add(trustedPackage);
}
}
}

15
spring-integration-core/src/main/java/org/springframework/integration/transformer/PayloadDeserializingTransformer.java
View File

@@ -49,21 +49,6 @@ public class PayloadDeserializingTransformer extends PayloadTypeConvertingTransf
setConverter(new AllowListDeserializingConverter(deserializer));
}
/**
* When using a {@link AllowListDeserializingConverter} (the default) add patterns
* for packages/classes that are allowed to be deserialized.
* A class can be fully qualified or a wildcard '*' is allowed at the
* beginning or end of the class name.
* Examples: {@code com.foo.*}, {@code *.MyClass}.
* @param patterns the patterns.
* @since 4.2.13
* @deprecated since 5.4 in favor of {@link #setAllowedPatterns(String...)}
*/
@Deprecated
public void setWhiteListPatterns(String... patterns) {
setAllowedPatterns(patterns);
}
/**
* When using a {@link AllowListDeserializingConverter} (the default) add patterns
* for packages/classes that are allowed to be deserialized.

10
spring-integration-core/src/main/resources/org/springframework/integration/config/spring-integration.xsd
View File

@@ -2787,16 +2787,6 @@
</xsd:appinfo>
</xsd:annotation>
</xsd:attribute>
<xsd:attribute name="white-list">
<xsd:annotation>
<xsd:documentation>
[DEPRECATED]
When using the default Deserializer, a list of package/class patterns indicating
classes that are allowed to be deserialized. Consider providing this if you receive
data from untrusted sources. Example: "com.mycom.*, com.yourcom.*".
</xsd:documentation>
</xsd:annotation>
</xsd:attribute>
<xsd:attribute name="allow-list">
<xsd:annotation>
<xsd:documentation>