ExternalVendorCode/corda
1
0
Fork 0
mirror of https://github.com/corda/corda.git synced 2025-06-16 14:18:20 +00:00
Code Issues Actions 2 Packages Projects Releases Wiki Activity

CORDA-2147 Use serialization strict mode during transaction verification. (#4312)

Browse Source 
* CORDA-2147 Use serialization strict mode during transaction verification.

* CORDA-2147 Address code review comments.

* CORDA-2147 Fix compilation error.
This commit is contained in:
Tudor Malene
2018-11-30 09:44:41 +00:00
committed by GitHub
parent 559932a581
commit 66e097b58d
13 changed files with 59 additions and 66 deletions
Download Patch File Download Diff File Expand all files Collapse all files

12
core/src/main/kotlin/net/corda/core/serialization/SerializationAPI.kt
View File

@ -150,6 +150,12 @@ interface SerializationContext {
* The default is false.
*/
val lenientCarpenterEnabled: Boolean
/**
* If true the carpenter will fail if the binary to be deserialized contains more fields then the current object from the classpath.
*
* The default is false.
*/
val preventDataLoss: Boolean
/**
* The use case we are serializing or deserializing for. See [UseCase].
*/
@ -171,6 +177,12 @@ interface SerializationContext {
*/
fun withLenientCarpenter(): SerializationContext
/**
* Return a new context based on this one but with a strict evolution.
* @see preventDataLoss
*/
fun withPreventDataLoss(): SerializationContext
/**
* Helper method to return a new context based on this context with the deserialization class loader changed.
*/

2
core/src/main/kotlin/net/corda/core/serialization/internal/AttachmentsClassLoader.kt
View File

@ -123,7 +123,7 @@ internal object AttachmentsClassLoaderBuilder {
val transactionClassLoader = AttachmentsClassLoaderBuilder.build(attachments)
// Create a new serializationContext for the current Transaction.
val transactionSerializationContext = SerializationFactory.defaultFactory.defaultContext.withClassLoader(transactionClassLoader)
val transactionSerializationContext = SerializationFactory.defaultFactory.defaultContext.withPreventDataLoss().withClassLoader(transactionClassLoader)
// Deserialize all relevant classes in the transaction classloader.
return SerializationFactory.defaultFactory.withCurrentContext(transactionSerializationContext) {