[Java] Better ergonomics for AllowListChecker
- Dominant language
- Java
- Stars
- 4.5k
- Forks
- 443
- Avg merge
- 5h 59m
- Merged PRs (30d)
- 77
Description
### Feature Request
```
AllowListChecker checker = new AllowListChecker(AllowListChecker.CheckLevel.STRICT);
ThreadSafeFory fory = new ThreadLocalFory(classLoader -> {
Fory f = Fory.builder().requireClassRegistration(true).withClassLoader(classLoader).build();
f.getClassResolver().setClassChecker(checker);
checker.addListener(f.getClassResolver());
return f;
});
checker.allowClass("org.example.*");
```
I think it makes sense `setClassChecker` doing `checker.addListener(f.getClassResolver());` automatically unless I'm missing something.
Also after adding AllowListChecker I still get this error in log
`ForyBuilder:477 [Test worker] - Class registration isn't forced, unknown classes can be deserialized. If the environment isn't secure, please enable class registration by `ForyBuilder#requireClassRegistration(true)` or configure TypeChecker by `TypeResolver#setTypeChecker``
I think the security error should be suppressed with a `TypeChecker` registered since I'm not allowing any random class.
### Is your feature request related to a problem? Please describe
_No response_
### Describe the solution you'd like
I think either registration or TypeChecker should stop the unsafe serialization error.
### Describe alternatives you've considered
_No response_
### Additional context
_No response_
Contributor guide
Assessment
This issue has not been assessed yet.