title: Safe ObjectInputStream.readObject from untrusted source
body: <p>I want to sent a significant number of Java objects over the Internet from client to server. Simple text base solutions (like json or xml) will not work due to the amount of data transferred. Even compression would take too long. I really need to exploit sharing present in the objects.</p>
  
  <p>Of course I would prefer not to implement a complete serialization implementation myself.</p>
  
  <p>One possible solution would be to use Object serialization in Java. As I cannot completely trust the client this poses a problem as a rogue client could instantiate some weird objects on the server.</p>
  
  <p>A possible solution would be to override ObjectInputStream.resolveClass. As I will only be transmitting objects from a limited set of classes I can easily check if the class being resolved belongs to that limited set.</p>
  
  <p>Can you guys poke holes in this idea? Have you done something similar yourself?</p>