Red Hat Summit Red Hat SummitApoyoConsolaDesarrolladoresIniciar una pruebaContacto

Este contenido no está disponible en el idioma seleccionado.

5.6. Security Options for JMS ObjectMessage Serialization

Overview
Copiar enlace

The javax.jms.ObjectMessage type can be used to send messages containing a serialized Java object. This feature has been available since JMS 1.0 and is supported by Apache ActiveMQ, but use of this feature is generally not recommended, for the following reasons:
  • Architecturally, messaging systems enable loose coupling between producers and consumers, but ObjectMessage re-introduces tight coupling, thereby negating a key benefit of the message-based architecture.
  • Using ObjectMessage introduces coupling of class paths between producers and consumers.
  • Using ObjectMessage presents a significant security risk, because the serialized objects can be used to transfer malicious code.

Security risks
Copiar enlace

ObjectMessage objects depend on Java serialization to marshal and unmarshal their object payload. This process is generally considered unsafe, because a malicious payload can exploit the host system. For this reason, starting from AMQ 6.3, AMQ forces users to explicitly whitelist packages that can be exchanged using ObjectMessage messages.

Whitelisting Java packages
Copiar enlace

To whitelist Java packages, so that they can be used in a serialized object message, you are required to list the acceptable packages in the org.apache.activemq.SERIALIZABLE_PACKAGES system property. This system property can be used both on the server side (broker) and on the client side.
For example, on the broker side, you can set this property in the InstallDir/etc/system.properties file, as follows: 
org.apache.activemq.SERIALIZABLE_PACKAGES="java.lang,java.util,org.apache.activemq,org.fusesource.hawtbuf,com.thoughtworks.xstream.mapper,com.mycompany.myapp"
Copy to Clipboard Toggle word wrap
Which adds the com.mycompany.myapp package to the list of trusted packages. Note that the other packages listed here are enabled by default, because they are necessary for the regular broker to work.

Bypassing the whitelist mechanism
Copiar enlace

In case you want to bypass the whitelist mechanism, you can allow all packages to be trusted by specifying the * wildcard character—for example: 
org.apache.activemq.SERIALIZABLE_PACKAGES="*"
Copy to Clipboard Toggle word wrap
Warning
Disabling the whitelist mechanism can be useful in a testing environment, but it should not be used in a deployed system.

Client-side whitelisting API
Copiar enlace

On the client side, you can also configure trusted packages using the org.apache.activemq.SERIALIZABLE_PACKAGES system property, but this approach is usually not convenient for client applications. An alternative approach is to use the API methods defined on the ActiveMQConnectionFactory class (where these API settings would override the system property, if it is set). There are two additional methods defined available:
  • The setTrustedPackages() method allows you to set the list of trusted packages you want to be to unserialize—for example: 
    ActiveMQConnectionFactory factory = new ActiveMQConnectionFactory("tcp://localhost:61616");
factory.setTrustedPackages(new ArrayList(Arrays.asList("org.apache.activemq.test,org.apache.camel.test".split(","))));
    Copy to Clipboard Toggle word wrap
    The list of trusted packages can also be set in XML. For example, a Camel endpoint in a Spring XML file can be configured as follows: 
    <bean id="connectionFactory" class="org.apache.activemq.spring.ActiveMQConnectionFactory">
    <property name="brokerURL" value="tcp://localhost:61616"/>
    <property name="trustedPackages">
        <list>
            <value>org.apache.activemq.test</value>
            <value>org.apache.camel.test</value>
        </list>
    </property>
</bean>
<bean id="jmsConfig" class="org.apache.camel.component.jms.JmsConfiguration">
    <property name="connectionFactory" ref="connectionFactory"/>
</bean>
<bean id="activemq" class="org.apache.activemq.camel.component.ActiveMQComponent">
    <property name="configuration" ref="jmsConfig"/>
</bean>
    Copy to Clipboard Toggle word wrap
  • The setTrustAllPackages() allows you to turn off the security check and trust all classes. It can be useful for testing purposes. For example: 
    ActiveMQConnectionFactory factory = new ActiveMQConnectionFactory("tcp://localhost:61616");
factory.setTrustAllPackages(true);
    Copy to Clipboard Toggle word wrap
    The whitelist mechanism can also be disabled in Spring XML as follows: 
    <bean id="connectionFactory" class="org.apache.activemq.spring.ActiveMQConnectionFactory">
    <property name="brokerURL" value="tcp://localhost:61616"/>
    <property name="trustAllPackages" value="true"/>
</bean>
<bean id="jmsConfig" class="org.apache.camel.component.jms.JmsConfiguration">
    <property name="connectionFactory" ref="connectionFactory"/>
</bean>
<bean id="activemq" class="org.apache.activemq.camel.component.ActiveMQComponent">
    <property name="configuration" ref="jmsConfig"/>
</bean>
    Copy to Clipboard Toggle word wrap
    Warning
    Disabling the whitelist mechanism can be useful in a testing environment, but it should not be used in a deployed system.
Volver arriba
Red Hat logoGithubredditYoutubeTwitter

Aprender

Pruebe, compre y venda

Comunidades

Acerca de la documentación de Red Hat

Ayudamos a los usuarios de Red Hat a innovar y alcanzar sus objetivos con nuestros productos y servicios con contenido en el que pueden confiar. Explore nuestras recientes actualizaciones.

Hacer que el código abierto sea más inclusivo

Red Hat se compromete a reemplazar el lenguaje problemático en nuestro código, documentación y propiedades web. Para más detalles, consulte el Blog de Red Hat.

Acerca de Red Hat

Ofrecemos soluciones reforzadas que facilitan a las empresas trabajar en plataformas y entornos, desde el centro de datos central hasta el perímetro de la red.

Theme

© 2025 Red Hat