spring-security-oauth2/src/main/java/org/springframework/security/oauth2/common/util/SerializationUtils.java
/**
		 * Resolve the class only if it's allowed to deserialize.
		 *
		 * @see ObjectInputStream#resolveClass(ObjectStreamClass)
		 */
Resolve the class only if it's allowed to deserialize.
Resolve the class only if it ' s allowed to deserialize .
@Override
		protected Class<?> resolveClass(ObjectStreamClass classDesc) throws IOException, ClassNotFoundException {
			if (isProhibited(classDesc.getName())) {
				throw new NotSerializableException("Not allowed to deserialize " + classDesc.getName());
			}
			if (this.classLoader != null) {
				return ClassUtils.forName(classDesc.getName(), this.classLoader);
			}
			return super.resolveClass(classDesc);
		}
@ Override protected Class < ? > resolveClass ( ObjectStreamClass classDesc ) throws IOException , ClassNotFoundException { if ( isProhibited ( classDesc . getName ( ) ) ) { throw new NotSerializableException ( "Not allowed to deserialize " + classDesc . getName ( ) ) ; } if ( this . classLoader != null ) { return ClassUtils . forName ( classDesc . getName ( ) , this . classLoader ) ; } return super . resolveClass ( classDesc ) ; }
Resolve the class only if it's allowed to deserialize.
Resolve the class only if it ' s allowed to deserialize .