What is the 'look-ahead deserialization' pattern, and how would you implement it without JEP 290?

## The timing problem Recall why native deserialization is dangerous: `ObjectInputStream.readObject()` reads class names from the *stream*, loads and instantiates those classes, and runs their magic hook methods (`readObject`, `readResolve`, `readExternal`) **during** reconstruction. So by the time control returns to your code (and your cast runs), any gadget chain has already executed. The defensive principle is therefore about **timing**: you must reject a bad class *before* it is instantiated. That early check is **look-ahead deserialization** — you 'look ahead' at the class descriptor in the stream before building the object. ## The pre-JEP-290 implementation: override `resolveClass` `ObjectInputStream` has a protected method called once per class in the stream, *before* the class's instances are created: ```java protected Class<?> resolveClass(ObjectStreamClass desc) ``` The argument `desc` is an `ObjectStreamClass` — metadata about the class about to be deserialized, crucially exposing `desc.getName()` (the fully-qualified class name). The default implementation just loads that class. By **subclassing** `ObjectInputStream` and overriding `resolveClass`, you can validate the name first and throw `java.io.InvalidClassException` for anything not on your allowlist, *before* `super.resolveClass(desc)` resolves/loads it. You must also consider: - **Arrays**: an allowed element type can appear as `[Lcom.example.Foo;` — handle the array form (strip leading `[` / `L`). - **Dynamic proxies**: override `resolveProxyClass(String[] interfaces)` too, since gadget chains often use `java.lang.reflect.Proxy`. - **Allowlist, not blocklist**: list the few classes you actually expect and reject the rest; blocklisting known gadgets misses future ones. ## Worked example ```java class SafeObjectInputStream extends ObjectInputStream { private static final Set<String> ALLOWED = Set.of( "com.example.dto.User", "com.example.dto.Address", "java.util.ArrayList", "java.lang.Integer"); SafeObjectInputStream(InputStream in) throws IOException { super(in); } @Override protected Class<?> resolveClass(ObjectStreamClass desc) throws IOException, ClassNotFoundException { String name = desc.getName(); // normalize array element types like [Lcom.example.dto.User; String base = name.replaceAll("^\\[+L?", "").replace(";", ""); if (!ALLOWED.contains(base)) { throw new InvalidClassException("Blocked deserialization", name); } return super.resolveClass(desc); } @Override protected Class<?> resolveProxyClass(String[] interfaces) throws IOException, ClassNotFoundException { throw new InvalidClassException("Proxy deserialization not allowed"); } } ``` The check runs once per class as the stream is read — before instantiation — so a forbidden gadget class throws and the chain never fires. ## Relationship to JEP 290 JEP 290's `ObjectInputFilter` performs the **same look-ahead** at the same point in the read, but as a **configurable callback** rather than a subclass — and it adds stream-metric checks (depth, refs, bytes, array length) for DoS bombs. If you're on Java 9+ (or 8u121+), prefer the filter: it's less error-prone (no array/proxy normalization gotchas), composable, and installable per-stream or process-wide. The `resolveClass` technique remains useful for older runtimes or when you can't change how a library constructs its stream but can subclass it. Ready-made: Apache Commons IO's `ValidatingObjectInputStream` implements allow/deny via `accept(...)`/`reject(...)` so you don't hand-roll `resolveClass`. ## Limits Look-ahead gates *which classes* may be built; it cannot vet a permitted class's internal behavior, and a too-broad allowlist re-opens the hole. It is **defense in depth** layered under the primary control: don't natively deserialize untrusted data — use a data-only format into known types. **Summary:** look-ahead = validate the class name before instantiation. Pre-JEP-290, override `resolveClass` (and `resolveProxyClass`) with an allowlist; JEP 290 standardizes the same idea as a configurable `ObjectInputFilter`.