Example of a deserialization filter for an unsafe RMI object

SaferRmiObject.java

public class Server {
  
    public void bindRemoteObject(Registry registry) throws Exception {
        ObjectInputFilter filter = info -> {
            if (info.serialClass().getCanonicalName().startsWith("com.safe.package.")) {
                return ObjectInputFilter.Status.ALLOWED;
            }
            return ObjectInputFilter.Status.REJECTED;
        };
        registry.bind("unsafe", UnicastRemoteObject.exportObject(new RemoteObjectImpl(), 12345, filter));
    }
}

interface RemoteObject extends Remote {
    void action(Object obj) throws RemoteException;
}

class RemoteObjectImpl implements RemoteObject {
    // ...
}