The JVM-wide filter factory is invoked when an ObjectInputStream is constructed and when the stream-specific filter is set. The parameters are the current filter and a requested filter and it returns the filter to be used for the stream. If the current filter is non-null, the filter factory must return a non-null filter; this is to prevent unintentional disabling of filtering after it has been enabled. The factory determines the filter to be used for ObjectInputStream streams based on its inputs, any other filters, context, or state that is available. The factory may throw runtime exceptions to signal incorrect use or invalid parameters. See the filter models for examples of composition and delegation.

Patterns are separated by ";" (semicolon). Whitespace is significant and is considered part of the pattern. If a pattern includes an equals assignment, "=" it sets a limit. If a limit appears more than once the last value is used.

• maxdepth=value - the maximum depth of a graph
• maxrefs=value - the maximum number of internal references
• maxbytes=value - the maximum number of bytes in the input stream
• maxarray=value - the maximum array length allowed

Other patterns match or reject class or package name as returned from Class.getName() and if an optional module name is present class.getModule().getName(). Note that for arrays the element type is used in the pattern, not the array type.

• If the pattern starts with "!", the class is rejected if the remaining pattern is matched; otherwise the class is allowed if the pattern matches.
• If the pattern contains "/", the non-empty prefix up to the "/" is the module name; if the module name matches the module name of the class then the remaining pattern is matched with the class name. If there is no "/", the module name is not compared.
• If the pattern ends with ".**" it matches any class in the package and all subpackages.
• If the pattern ends with ".*" it matches any class in the package.
• If the pattern ends with "*", it matches any class with the pattern as a prefix.
• If the pattern is equal to the class name, it matches.
• Otherwise, the pattern is not matched.

The resulting filter performs the limit checks and then tries to match the class, if any. If any of the limits are exceeded, the filter returns Status.REJECTED. If the class is an array type, the class to be matched is the element type. Arrays of any number of dimensions are treated the same as the element type. For example, a pattern of "!example.Foo", rejects creation of any instance or array of example.Foo. The first pattern that matches, working from left to right, determines the Status.ALLOWED or Status.REJECTED result. If the limits are not exceeded and no pattern matches the class, the result is Status.UNDECIDED.