JDK-8185346 : Relax RMI Registry Serial Filter to allow arrays of any type
  • Type: Bug
  • Component: core-libs
  • Sub-Component: java.rmi
  • Affected Version: 6u141,7u131,8u121,9
  • Priority: P3
  • Status: Resolved
  • Resolution: Fixed
  • Submitted: 2017-07-26
  • Updated: 2021-05-25
  • Resolved: 2017-08-16
The Version table provides details related to the release that this issue/RFE will be addressed.

Unresolved : Release in which this issue/RFE will be addressed.
Resolved: Release in which this issue/RFE has been resolved.
Fixed : Release in which this issue/RFE has been fixed. The release containing this fix may be available for download as an Early Access Release or a General Availability Release.

To download the current JDK release, click here.
JDK 10 JDK 7 JDK 8
10 b20Fixed 7u161Fixed 8u152Fixed
Related Reports
CSR :  
JDK-8185539 - Relax RMI Registry Serial Filter to allow arrays of any type
Sub Tasks
JDK-8193788 :  
Release Note: RMI Registry Filter Allows Binding Arrays of Any Type - Closed
Description
The serialization filter applied to the RMI Registry restricts the types of objects that can be bound in the registry based on the type of the value.
For array types, the element type is restricted to a known list of types.

Compatibility issues have been raised based on attempts to bind java.lang.Object[] arrays. Arrays of any type are serializable.

Arrays, of any type, do not pose a risk except based on the array size, which is checked by the maxarray limit.
Individual objects inserted in the array are checked separately.

The filter should be modified to check only the array size against the limit and otherwise allow arrays of any type.
Comments
Review thread: http://mail.openjdk.java.net/pipermail/core-libs-dev/2017-August/048738.html
04-08-2017
The workaround is to use the override of the registry filter to allow the restricted type(s), for example: -Dsun.rmi.registry.registryFilter=java.lang.Object -or- -Dsun.rmi.registry.registryFilter=*
26-07-2017