import java.io.ByteArrayInputStream;
import java.io.ByteArrayOutputStream;
import java.io.IOException;
import java.io.InvalidClassException;
import java.io.ObjectInputFilter;
import java.io.ObjectInputStream;
import java.io.ObjectOutputStream;
import java.io.Serializable;

public class FilterDeserialisasi {

    static class Pegawai implements Serializable {
        private static final long serialVersionUID = 1L;
        private final String nama;

        Pegawai(String nama) {
            this.nama = nama;
        }

        @Override
        public String toString() {
            return "Pegawai(" + nama + ")";
        }
    }

    static class SkripLama implements Serializable {
        private static final long serialVersionUID = 1L;
        public final java.util.ArrayList<String> langkah = new java.util.ArrayList<>();

        @Override
        public String toString() {
            return "SkripLama(" + langkah + ")";
        }
    }

    static byte[] tulis(Object... objek) throws IOException {
        var penampung = new ByteArrayOutputStream();
        try (var keluar = new ObjectOutputStream(penampung)) {
            for (Object o : objek) {
                keluar.writeObject(o);
            }
        }
        return penampung.toByteArray();
    }

    public static void main(String[] args) throws Exception {
        ObjectInputFilter hanyaPegawai = ObjectInputFilter.Config.createFilter(
                "FilterDeserialisasi$Pegawai;java.base/*;!*");

        byte[] aman = tulis(new Pegawai("Siti"));
        try (var masuk = new ObjectInputStream(new ByteArrayInputStream(aman))) {
            masuk.setObjectInputFilter(hanyaPegawai);
            System.out.println("dibaca : " + masuk.readObject());
        }

        byte[] mencurigakan = tulis(new Pegawai("Budi"), new SkripLama());
        try (var masuk = new ObjectInputStream(new ByteArrayInputStream(mencurigakan))) {
            masuk.setObjectInputFilter(hanyaPegawai);
            System.out.println("dibaca : " + masuk.readObject());
            try {
                System.out.println("dibaca : " + masuk.readObject());
            } catch (InvalidClassException e) {
                System.out.println("ditolak: " + e.getMessage());
            }
        }
    }
}