对象流过滤器写了允许条件，为什么其他类仍能读进来？

import java.io.ByteArrayInputStream;
import java.io.ByteArrayOutputStream;
import java.io.IOException;
import java.io.InvalidClassException;
import java.io.ObjectInputFilter;
import java.io.ObjectInputStream;
import java.io.ObjectOutputStream;
import java.io.Serial;
import java.io.Serializable;
import java.util.ArrayList;
import java.util.List;

public class ObjectFilterDemo {
    private static int checks;
    static final class Allowed implements Serializable {
        @Serial private static final long serialVersionUID = 1L;
        final int value;
        Allowed(int value) { this.value = value; }
    }
    static final class Other implements Serializable {
        @Serial private static final long serialVersionUID = 1L;
        final int value;
        Other(int value) { this.value = value; }
    }
    record Event(Class<?> type, long length, long depth, long refs, long bytes,
                 ObjectInputFilter.Status status) {}

    static final class Trace implements ObjectInputFilter {
        final ObjectInputFilter delegate;
        final List<Event> events = new ArrayList<>();
        Trace(ObjectInputFilter delegate) { this.delegate = delegate; }
        @Override public Status checkInput(FilterInfo info) {
            Status status = delegate.checkInput(info);
            events.add(new Event(info.serialClass(), info.arrayLength(), info.depth(),
                    info.references(), info.streamBytes(), status));
            return status;
        }
        boolean saw(Class<?> type, long length, Status status) {
            return events.stream().anyMatch(e -> e.type() == type && e.length() == length && e.status() == status);
        }
    }
    private static void check(boolean ok, String message) {
        if (!ok) throw new AssertionError(message);
        checks++;
    }
    private static byte[] encodeOwn(Serializable value) throws IOException {
        ByteArrayOutputStream bytes = new ByteArrayOutputStream();
        try (ObjectOutputStream output = new ObjectOutputStream(bytes)) { output.writeObject(value); }
        return bytes.toByteArray();
    }
    private static Object decodeOwn(byte[] bytes, ObjectInputFilter filter) throws IOException, ClassNotFoundException {
        try (ObjectInputStream input = new ObjectInputStream(new ByteArrayInputStream(bytes))) {
            input.setObjectInputFilter(filter);
            // Do not silently run this isolated experiment under a custom filter factory.
            if (input.getObjectInputFilter() != filter)
                throw new IllegalStateException("experiment requires the requested stream filter");
            return input.readObject();
        }
    }
    private static boolean rejected(byte[] bytes, ObjectInputFilter filter) throws Exception {
        try { decodeOwn(bytes, filter); return false; }
        catch (InvalidClassException expected) { return true; }
    }

    public static void main(String[] args) throws Exception {
        ObjectInputFilter loose = ObjectInputFilter.allowFilter(
                type -> type == Allowed.class, ObjectInputFilter.Status.UNDECIDED);
        byte[] otherBytes = encodeOwn(new Other(7));
        Trace looseTrace = new Trace(loose);
        Other other = (Other) decodeOwn(otherBytes, looseTrace);
        check(other.value == 7, "undecided Other still restored");
        check(looseTrace.saw(Other.class, -1, ObjectInputFilter.Status.UNDECIDED), "Other class was actually checked");
        ObjectInputFilter strict = ObjectInputFilter.rejectUndecidedClass(loose);
        Trace strictTrace = new Trace(strict);
        check(rejected(otherBytes, strictTrace), "undecided ordinary class now rejected");
        check(strictTrace.saw(Other.class, -1, ObjectInputFilter.Status.REJECTED), "record rejected status");
        Allowed allowed = (Allowed) decodeOwn(encodeOwn(new Allowed(9)), strict);
        check(allowed.value == 9, "explicitly allowed class succeeds");
        System.out.println("classes: Other+UNDECIDED=read; Other+strict=InvalidClassException; Allowed+strict=read");
        Allowed negative = (Allowed) decodeOwn(encodeOwn(new Allowed(-9)), strict);
        check(negative.value == -9, "type-only rule does not validate the integer field");
        System.out.println("business_value: Allowed.value=-9; type_filter=read");

        // An existing reference triggers a metrics event with no new class to check.
        Allowed shared = new Allowed(11);
        Trace references = new Trace(info -> {
            Class<?> type = info.serialClass();
            if (type == null) return ObjectInputFilter.Status.UNDECIDED;
            return type == Object[].class || type == Allowed.class
                    ? ObjectInputFilter.Status.ALLOWED : ObjectInputFilter.Status.REJECTED;
        });
        Object[] pair = (Object[]) decodeOwn(encodeOwn(new Object[] {shared, shared}), references);
        check(pair.length == 2 && pair[0] == pair[1], "shared reference restored as shared");
        check(references.saw(null, -1, ObjectInputFilter.Status.UNDECIDED), "null class metrics event exists");
        check(references.events.stream().filter(e -> e.type() == null)
                .allMatch(e -> e.depth() >= 1 && e.refs() >= 1 && e.bytes() >= 0), "metrics available without a class");
        System.out.println("references: shared_identity=true; serialClass_null=true; arrayLength=-1; metrics_present=true");

        ObjectInputFilter maxFour = info -> info.arrayLength() > 4
                ? ObjectInputFilter.Status.REJECTED : ObjectInputFilter.Status.UNDECIDED;
        Trace small = new Trace(maxFour);
        int[] three = (int[]) decodeOwn(encodeOwn(new int[] {1, 2, 3}), small);
        check(three.length == 3 && three[2] == 3, "small primitive array restored");
        check(small.saw(int[].class, 3, ObjectInputFilter.Status.UNDECIDED), "actual length-three event");
        Trace emptyTrace = new Trace(maxFour);
        check(((int[]) decodeOwn(encodeOwn(new int[0]), emptyTrace)).length == 0, "empty array accepted");
        check(emptyTrace.saw(int[].class, 0, ObjectInputFilter.Status.UNDECIDED), "zero length is not minus one");
        Trace boundary = new Trace(maxFour);
        check(((int[]) decodeOwn(encodeOwn(new int[4]), boundary)).length == 4, "exact maximum accepted");
        check(boundary.saw(int[].class, 4, ObjectInputFilter.Status.UNDECIDED), "actual length-four event");
        Trace large = new Trace(maxFour);
        check(rejected(encodeOwn(new int[5]), large), "length-five array rejected");
        check(large.saw(int[].class, 5, ObjectInputFilter.Status.REJECTED), "actual length-five rejection event");
        Trace primitiveStrict = new Trace(strict);
        check(((int[]) decodeOwn(encodeOwn(new int[3]), primitiveStrict)).length == 3,
                "rejectUndecidedClass still permits undecided primitive arrays");
        check(primitiveStrict.saw(int[].class, 3, ObjectInputFilter.Status.UNDECIDED), "primitive array special case recorded");
        System.out.println("arrays: length0_3_4=read; length5=InvalidClassException; primitive_array_under_strict=UNDECIDED_read");

        Trace stringTrace = new Trace(info -> ObjectInputFilter.Status.REJECTED);
        Object text = decodeOwn(encodeOwn("own-text"), stringTrace);
        check("own-text".equals(text), "direct String restored");
        check(stringTrace.events.isEmpty(), "direct String invokes no filter callback");
        System.out.println("direct_string: value=own-text; reject_all_callback_calls=0; read=true");
        System.out.println("PASS checks=" + checks + "; input=program_generated_byte_arrays_only");
    }
}

import java.io.ByteArrayInputStream;
import java.io.ByteArrayOutputStream;
import java.io.IOException;
import java.io.InvalidClassException;
import java.io.ObjectInputFilter;
import java.io.ObjectInputStream;
import java.io.ObjectOutputStream;
import java.io.Serial;
import java.io.Serializable;
import java.util.ArrayList;
import java.util.Arrays;
import java.util.List;

/** Fixed local observations, not an input service or a browser simulation. */
public class FilterMatrixDemo {
    private static int checks;
    private static int outcomeChecks;

    static final class Allowed implements Serializable {
        @Serial private static final long serialVersionUID = 1L;
        final int value;
        Allowed(int value) { this.value = value; }
    }
    static final class Other implements Serializable {
        @Serial private static final long serialVersionUID = 1L;
        final int value;
        Other(int value) { this.value = value; }
    }
    record Sample(String id, String label, Serializable value) {}
    record Policy(String id, String label, ObjectInputFilter filter) {}
    record Callback(String className, long arrayLength, String status) {}
    record Cell(String sampleId, String sampleLabel, String policyId, String policyLabel,
                String outcome, String observedType, Object observedValue,
                String exceptionType, List<Callback> callbacks) {}

    static final class Trace implements ObjectInputFilter {
        final ObjectInputFilter delegate;
        final List<Callback> callbacks = new ArrayList<>();
        Trace(ObjectInputFilter delegate) { this.delegate = delegate; }
        @Override public Status checkInput(FilterInfo info) {
            Status status = delegate.checkInput(info);
            Class<?> type = info.serialClass();
            callbacks.add(new Callback(type == null ? null : type.getSimpleName(),
                    info.arrayLength(), status.name()));
            return status;
        }
    }

    private static void check(boolean condition, String message) {
        if (!condition) throw new AssertionError(message);
        checks++;
    }
    private static byte[] encodeOwn(Serializable value) throws IOException {
        ByteArrayOutputStream bytes = new ByteArrayOutputStream();
        try (ObjectOutputStream output = new ObjectOutputStream(bytes)) { output.writeObject(value); }
        return bytes.toByteArray();
    }
    private static Object valueOf(Object object) {
        if (object instanceof Allowed a) return a.value;
        if (object instanceof Other o) return o.value;
        if (object instanceof int[] array) return array.clone();
        if (object instanceof String text) return text;
        throw new AssertionError("unexpected observed type");
    }
    private static boolean sameValue(Object actual, Object expected) {
        if (actual instanceof int[] a && expected instanceof int[] e) return Arrays.equals(a, e);
        return actual.equals(expected);
    }

    private static Cell observe(Sample sample, Policy policy) throws Exception {
        // Every cell has a new byte stream and Trace; no callbacks leak from other cells.
        byte[] bytes = encodeOwn(sample.value());
        Trace trace = new Trace(policy.filter());
        try (ObjectInputStream input = new ObjectInputStream(new ByteArrayInputStream(bytes))) {
            input.setObjectInputFilter(trace);
            check(input.getObjectInputFilter() == trace,
                    "requested stream filter was replaced: " + sample.id() + "/" + policy.id());
            try {
                Object restored = input.readObject();
                return new Cell(sample.id(), sample.label(), policy.id(), policy.label(),
                        "read", restored.getClass().getSimpleName(), valueOf(restored), null,
                        List.copyOf(trace.callbacks));
            } catch (InvalidClassException rejected) {
                return new Cell(sample.id(), sample.label(), policy.id(), policy.label(),
                        "rejected", null, null, rejected.getClass().getSimpleName(),
                        List.copyOf(trace.callbacks));
            }
        }
    }

    private static String quote(String text) {
        if (text == null) return "null";
        StringBuilder out = new StringBuilder("\"");
        for (int i = 0; i < text.length(); i++) {
            char ch = text.charAt(i);
            switch (ch) {
                case '"' -> out.append("\\\"");
                case '\\' -> out.append("\\\\");
                case '\b' -> out.append("\\b");
                case '\f' -> out.append("\\f");
                case '\n' -> out.append("\\n");
                case '\r' -> out.append("\\r");
                case '\t' -> out.append("\\t");
                default -> {
                    if (ch < 0x20) {
                        String hex = Integer.toHexString(ch);
                        out.append("\\u").append("0".repeat(4 - hex.length())).append(hex);
                    } else out.append(ch);
                }
            }
        }
        return out.append('"').toString();
    }
    private static String jsonValue(Object value) {
        if (value == null) return "null";
        if (value instanceof Integer number) return number.toString();
        if (value instanceof String text) return quote(text);
        if (value instanceof int[] array) {
            StringBuilder out = new StringBuilder("[");
            for (int i = 0; i < array.length; i++) { if (i > 0) out.append(','); out.append(array[i]); }
            return out.append(']').toString();
        }
        throw new AssertionError("unexpected JSON value");
    }
    private static String render(List<Cell> cells) {
        StringBuilder out = new StringBuilder();
        out.append("{\n  \"schemaVersion\": 1,\n")
                .append("  \"recordType\": \"fixed-actual-java-observations\",\n")
                .append("  \"sampleCount\": 6,\n  \"policyCount\": 4,\n  \"cellCount\": 24,\n")
                .append("  \"outcomeChecks\": ").append(outcomeChecks).append(",\n")
                .append("  \"checks\": ").append(checks).append(",\n  \"cells\": [\n");
        for (int i = 0; i < cells.size(); i++) {
            Cell cell = cells.get(i);
            if (i > 0) out.append(",\n");
            out.append("    {\"sampleId\":").append(quote(cell.sampleId()))
                    .append(",\"sampleLabel\":").append(quote(cell.sampleLabel()))
                    .append(",\"policyId\":").append(quote(cell.policyId()))
                    .append(",\"policyLabel\":").append(quote(cell.policyLabel()))
                    .append(",\"outcome\":").append(quote(cell.outcome()))
                    .append(",\"observedType\":").append(quote(cell.observedType()))
                    .append(",\"observedValue\":").append(jsonValue(cell.observedValue()))
                    .append(",\"exceptionType\":").append(quote(cell.exceptionType()))
                    .append(",\"callbacks\":[");
            for (int j = 0; j < cell.callbacks().size(); j++) {
                if (j > 0) out.append(',');
                Callback callback = cell.callbacks().get(j);
                out.append("{\"class\":").append(quote(callback.className()))
                        .append(",\"arrayLength\":").append(callback.arrayLength())
                        .append(",\"status\":").append(quote(callback.status())).append('}');
            }
            out.append("]}");
        }
        return out.append("\n  ]\n}").toString();
    }

    public static void main(String[] args) throws Exception {
        List<Sample> samples = List.of(
                new Sample("allowed-9", "Allowed(9)", new Allowed(9)),
                new Sample("allowed-negative9", "Allowed(-9)", new Allowed(-9)),
                new Sample("other-7", "Other(7)", new Other(7)),
                new Sample("int-array-3", "int[3] = [1,2,3]", new int[] {1, 2, 3}),
                new Sample("int-array-5", "int[5] = [1,2,3,4,5]", new int[] {1, 2, 3, 4, 5}),
                new Sample("direct-string", "String own-text", "own-text"));
        ObjectInputFilter loose = ObjectInputFilter.allowFilter(
                type -> type == Allowed.class, ObjectInputFilter.Status.UNDECIDED);
        ObjectInputFilter strict = ObjectInputFilter.rejectUndecidedClass(loose);
        ObjectInputFilter maxArray4 = info -> info.arrayLength() > 4
                ? ObjectInputFilter.Status.REJECTED : ObjectInputFilter.Status.UNDECIDED;
        List<Policy> policies = List.of(
                new Policy("loose", "Allowed -> ALLOWED; others -> UNDECIDED", loose),
                new Policy("strict", "rejectUndecidedClass(loose)", strict),
                new Policy("max-array-4", "arrayLength > 4 -> REJECTED; otherwise UNDECIDED", maxArray4),
                new Policy("strict-and-max-array-4", "merge(strict,maxArray4)", ObjectInputFilter.merge(strict, maxArray4)));
        // Independent expected outcome table in sample order, then policy order.
        String[][] expected = {
                {"read", "read", "read", "read"},
                {"read", "read", "read", "read"},
                {"read", "rejected", "read", "rejected"},
                {"read", "read", "read", "read"},
                {"read", "read", "rejected", "rejected"},
                {"read", "read", "read", "read"}
        };
        List<Cell> cells = new ArrayList<>();
        for (int i = 0; i < samples.size(); i++) {
            Sample sample = samples.get(i);
            for (int j = 0; j < policies.size(); j++) {
                Policy policy = policies.get(j);
                Cell cell = observe(sample, policy);
                check(cell.outcome().equals(expected[i][j]), "outcome: " + sample.id() + "/" + policy.id());
                outcomeChecks++;
                if (cell.outcome().equals("read")) {
                    check(cell.observedType().equals(sample.value().getClass().getSimpleName())
                                    && sameValue(cell.observedValue(), valueOf(sample.value())),
                            "restored type/value: " + sample.id() + "/" + policy.id());
                } else {
                    check(cell.callbacks().stream().anyMatch(c -> c.status().equals("REJECTED")),
                            "rejection must have actual filter evidence");
                }
                if (sample.value() instanceof String) {
                    check(cell.callbacks().isEmpty(), "direct String must produce zero callbacks");
                } else {
                    check(!cell.callbacks().isEmpty(), "non-String sample must have observed callbacks");
                }
                if (sample.value() instanceof int[] array) {
                    String status = cell.outcome().equals("rejected") ? "REJECTED" : "UNDECIDED";
                    check(cell.callbacks().stream().anyMatch(c -> "int[]".equals(c.className())
                                    && c.arrayLength() == array.length && c.status().equals(status)),
                            "actual array length and status must be recorded");
                }
                cells.add(cell);
            }
        }
        check(cells.size() == 24 && outcomeChecks == 24, "complete six by four matrix");
        System.out.println(render(cells));
    }
}