[#2831] - Add optional JEP-290 ObjectInputFilter support to DefaultSerializer, with a conservative resource-limit default on RememberMe deserialization (#2832) * [#2831] - Add optional JEP-290 ObjectInputFilter support to DefaultSerializer Add an optional ObjectInputFilter (getObjectInputFilter/setObjectInputFilter, null by default) to DefaultSerializer, applied in deserialize() when set, and pre-configure AbstractRememberMeManager's default serializer with a conservative resource-limit-only filter (maxdepth=30;maxarray=100000;maxrefs=10000;maxbytes=10000000). Document the one-line class-based allow-list override on getSerializer(). The null default means no behavior change for existing callers. * Address review: pull ObjectInputFilter API up into Serializer, @since 3.0.1 Move getObjectInputFilter/setObjectInputFilter onto the Serializer interface as default methods (getter returns null, setter is a no-op); DefaultSerializer overrides them. AbstractRememberMeManager now calls serializer.setObjectInputFilter(...) directly, removing the instanceof check, the cast, and @SuppressWarnings. The documented override example and the test drop their casts too. Change all @since 3.1 occurrences to 3.0.1. * Potential fix for pull request finding Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com> --------- Co-authored-by: Lenny Primak <lenny@flowlogix.com> Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
Apache Shiro is a powerful and easy-to-use Java security framework that performs authentication, authorization, cryptography, and session management. With Shiro’s easy-to-understand API, you can quickly and easily secure any application – from the smallest mobile applications to the largest web and enterprise applications.
