update deny rule

apache · Aug 27, 2022 · e3d40e8 · e3d40e8
1 parent 7864c23
commit e3d40e8
Showing 1 changed file with 10 additions and 10 deletions.
diff --git a/src/main/java/com/alibaba/com/caucho/hessian/io/SerializerFactory.java b/src/main/java/com/alibaba/com/caucho/hessian/io/SerializerFactory.java
@@ -343,11 +343,6 @@ public Serializer getSerializer(Class cl)
             serializer = factory.getSerializer(cl);
         }
 
-        if (!Serializable.class.isAssignableFrom(cl)
-                && !_isAllowNonSerializable) {
-            throw new IllegalStateException("Serialized class " + cl.getName() + " must implement java.io.Serializable");
-        }
-
         if (serializer != null) {
 
         } else if (isZoneId(cl)) //must before "else if (JavaSerializer.getWriteReplace(cl) != null)"
@@ -419,6 +414,11 @@ protected Serializer getDefaultSerializer(Class cl) {
         if (_defaultSerializer != null)
             return _defaultSerializer;
 
+        if (!Serializable.class.isAssignableFrom(cl)
+                && !_isAllowNonSerializable) {
+            throw new IllegalStateException("Serialized class " + cl.getName() + " must implement java.io.Serializable");
+        }
+
         return new JavaSerializer(cl, _loader);
     }
 
@@ -453,11 +453,6 @@ public Deserializer getDeserializer(Class cl)
             deserializer = factory.getDeserializer(cl);
         }
 
-        if (!Serializable.class.isAssignableFrom(cl)
-                && !_isAllowNonSerializable) {
-            throw new IllegalStateException("Serialized class " + cl.getName() + " must implement java.io.Serializable");
-        }
-
         if (deserializer != null) {
         } else if (Collection.class.isAssignableFrom(cl))
             deserializer = new CollectionDeserializer(cl);
@@ -500,6 +495,11 @@ else if (Class.class.equals(cl))
      * @return a serializer object for the serialization.
      */
     protected Deserializer getDefaultDeserializer(Class cl) {
+        if (!Serializable.class.isAssignableFrom(cl)
+                && !_isAllowNonSerializable) {
+            throw new IllegalStateException("Serialized class " + cl.getName() + " must implement java.io.Serializable");
+        }
+
         return new JavaDeserializer(cl);
     }