How do I add a type to GWT's Serialization Policy whitelist?

Question

GWT's serializer has limited java.io.Serializable support, but for security reasons there is a whitelist of types it supports. The documentation I've found, for example this FAQ entry, says that any types you want to serialize "must be included" on the whitelist, and that the list is generated at compile time, but doesn't explain how the compiler decides what goes on the whitelist.

The generated list contains a number of types that are part of the standard library, such as java.lang.String and java.util.HashMap. I get an error when trying to serialize java.sql.Date, which implements the Serializable interface, but is not on the whitelist. How can I add this type to the list?

Answer 1

The whitelist is generated by the gwt compiler and contains all the entries that are designated by the IsSerializable marker interface.

To add a type to the list you just need to make sure that the class implements the IsSerializable interface.

Answer 2

Any specific types that you include in your service interface and any types that they reference will be automatically whitelisted, as long as they implement java.io.Serializable, eg:

public String getStringForDates(ArrayList<java.util.Date> dates);

Will result in ArrayList and Date both being included on the whitelist.

It gets trickier if you try and use java.lang.Object instead of specific types:

public Object getObjectForString(String str);

Because the compiler doesn't know what to whitelist. In that case if the objects are not referenced anywhere in your service interface, you have to mark them explicitly with the IsSerializable interface, otherwise it won't let you pass them through the RPC mechanism.

Answer 3

So you can't hack the whitelist by just editing the .gwt.rpc file directly?

Answer 4

There's a workaround: Define a new Dummy class with member fields of all the types that you want to be included in serialization. Then add a method to your RPC interface:

Dummy dummy(Dummy d);

The implementation is just this:

Dummy dummy(Dummy d) { return d; }

And the async interface will have this:

void dummy(Dummy d, AsyncCallback< Dummy> callback);

The GWT compiler will pick this up, and because the Dummy class references those types, it will include them in the white list.

Example Dummy class:

public class Dummy implements IsSerializable {
    private String s; private Long l; private Date d;
}

Answer 5

Gilead, in dynamic proxy mode, generates "cloned" classes dynamically, turning a class Person into Person_gilead_15, for example. So, in this case there is no class, dummy or otherwise, for the compiler to analise. The name Person_gilead_15 would have to be added directly in the whitelist. How to include these in the serialization policy whitelist

Answer 6

IMHO the simpliest way how to access whitelist programatically is to create class similar to this:

public class SerializableWhitelist implements IsSerializable { String[] dummy1; SomeOtherThingsIWishToSerialize dummy2;

}

and include it in the .client package (so it gets analyzed by the compiler)

I couldn't find a better way to enable tranfer of unparametrized maps, which is obviously what you sometimes need in order to create more generic services..

Answer 7

to ensure the desired result delete all war//gwt/*.gwt.rpc

Answer 8

To anyone who will have the same question and doesn't find previous answers satisfactory...

I'm using GWT with GWTController, since I'm using Spring, which I modified as described in this message. The message explains how to modify GrailsRemoteServiceServlet, but GWTController calls RPC.decodeRequest() and RPC.encodeResponseForSuccess() in the same way.

This is the final version of GWTController I'm using:

/**
 * Used to instantiate GWT server in Spring context.
 *
 * Original version from <a href="http://docs.google.com/Doc?docid=dw2zgx2_25492p5qxfq&amp;hl=en"&gt;this tutorial</a>.
 * 
 * ...fixed to work as explained <a href="http://blog.js-development.com/2009/09/gwt-meets-spring.html"&gt;in this tutorial</a>.
 * 
 * ...and then fixed to use StandardSerializationPolicy as explained in
 * <a href="http://markmail.org/message/k5j2vni6yzcokjsw"&gt;this message</a> to allow
 * using Serializable instead of IsSerializable in model.
 */
public class GWTController extends RemoteServiceServlet implements Controller, ServletContextAware {

 // Instance fields

 private RemoteService remoteService;

 private Class<? extends RemoteService> remoteServiceClass;

 private ServletContext servletContext;

 // Public methods

 /**
  * Call GWT's RemoteService doPost() method and return null.
  * 
  * @param request
  *            The current HTTP request
  * @param response
  *            The current HTTP response
  * @return A ModelAndView to render, or null if handled directly
  * @throws Exception
  *             In case of errors
  */
 public ModelAndView handleRequest(HttpServletRequest request, HttpServletResponse response) throws Exception {
  doPost(request, response);
  return null; // response handled by GWT RPC over XmlHttpRequest
 }

 /**
  * Process the RPC request encoded into the payload string and return a string that encodes either the method return
  * or an exception thrown by it.
  * 
  * @param payload
  *            The RPC payload
  */
 public String processCall(String payload) throws SerializationException {
  try {
   RPCRequest rpcRequest = RPC.decodeRequest(payload, this.remoteServiceClass, this);

   // delegate work to the spring injected service
   return RPC.invokeAndEncodeResponse(this.remoteService, rpcRequest.getMethod(), rpcRequest.getParameters(), rpcRequest.getSerializationPolicy());
  } catch (IncompatibleRemoteServiceException e) {
   return RPC.encodeResponseForFailure(null, e);
  }
 }

 /**
  * Setter for Spring injection of the GWT RemoteService object.
  * 
  * @param RemoteService
  *            The GWT RemoteService implementation that will be delegated to by the {@code GWTController}.
  */
 public void setRemoteService(RemoteService remoteService) {
  this.remoteService = remoteService;
  this.remoteServiceClass = this.remoteService.getClass();
 }

 @Override
 public ServletContext getServletContext() {
  return servletContext;
 }

 public void setServletContext(ServletContext servletContext) {
  this.servletContext = servletContext;
 }
}

Answer 9

The whitelist is generated by the gwt compiler and contains all the entries that are designated by the IsSerializable marker interface.

To add a type to the list you just need to make sure that the class implements the IsSerializable interface.

-- Andrej

This is probably the easiest solution. The only thing to remember with this is that all the classes that you want to serialize should have "public, no-argument" constructor, and (depending upon requirements) setter methods for the member fields.