Class InstantiateTransformer
java.lang.Object
org.apache.commons.collections.functors.InstantiateTransformer
- All Implemented Interfaces:
Serializable
,Transformer
Transformer implementation that creates a new object instance by reflection.
WARNING: from v3.2.2 onwards this class will throw an
UnsupportedOperationException
when trying to serialize or
de-serialize an instance to prevent potential remote code execution exploits.
In order to re-enable serialization support for InstantiateTransformer
the following system property can be used (via -Dproperty=true):
org.apache.commons.collections.enableUnsafeSerialization
- Since:
- Commons Collections 3.0
- Version:
- $Revision: 1713845 $ $Date: 2015-11-11 15:02:16 +0100 (Wed, 11 Nov 2015) $
- See Also:
-
Field Summary
FieldsModifier and TypeFieldDescriptionprivate final Object[]
The constructor argumentsprivate final Class[]
The constructor parameter typesstatic final Transformer
Singleton instance that uses the no arg constructorprivate static final long
The serial version -
Constructor Summary
ConstructorsModifierConstructorDescriptionprivate
Constructor for no arg instance.InstantiateTransformer
(Class[] paramTypes, Object[] args) Constructor that performs no validation. -
Method Summary
Modifier and TypeMethodDescriptionstatic Transformer
getInstance
(Class[] paramTypes, Object[] args) Transformer method that performs validation.private void
Overrides the default readObject implementation to prevent de-serialization (see COLLECTIONS-580).Transforms the input Class object to a result by instantiation.private void
Overrides the default writeObject implementation to prevent serialization (see COLLECTIONS-580).
-
Field Details
-
serialVersionUID
private static final long serialVersionUIDThe serial version- See Also:
-
NO_ARG_INSTANCE
Singleton instance that uses the no arg constructor -
iParamTypes
The constructor parameter types -
iArgs
The constructor arguments
-
-
Constructor Details
-
InstantiateTransformer
private InstantiateTransformer()Constructor for no arg instance. -
InstantiateTransformer
Constructor that performs no validation. UsegetInstance
if you want that.- Parameters:
paramTypes
- the constructor parameter types, not clonedargs
- the constructor arguments, not cloned
-
-
Method Details
-
getInstance
Transformer method that performs validation.- Parameters:
paramTypes
- the constructor parameter typesargs
- the constructor arguments- Returns:
- an instantiate transformer
-
transform
Transforms the input Class object to a result by instantiation.- Specified by:
transform
in interfaceTransformer
- Parameters:
input
- the input object to transform- Returns:
- the transformed result
-
writeObject
Overrides the default writeObject implementation to prevent serialization (see COLLECTIONS-580).- Throws:
IOException
-
readObject
Overrides the default readObject implementation to prevent de-serialization (see COLLECTIONS-580).- Throws:
ClassNotFoundException
IOException
-