public final Object readObject()
            throws IOException, ClassNotFoundException
{
    String enabled = java.security.Security.getProperty("paranoid.serialization.enabled");
    if (! Boolean.parseBoolean(enabled)) {
        throw new InvalidClassException("Object deserialization is disabled!");
    }

    ...
}

/** Set of blacklisted class name patterns. */
private static final java.util.Set<Pattern> blacklistPatterns;

/** Set of whitelisted class name patterns. */
private static final java.util.Set<Pattern> whitelistPatterns;

// JUL isn't ideal, but it's the out of the box one.
private static final Logger logger = Logger.getLogger("java.io.ObjectInputStream");

static {
    ...

    final String blacklist = Security.getProperty("paranoid.serialization.blacklist");
    blacklistPatterns = parsePatterns(blacklist);

    final String whitelist = Security.getProperty("paranoid.serialization.whitelist");
    whitelistPatterns = parsePatterns(whitelist);
}

private static Set<Pattern> parsePatterns(String listString) {
    final Set<Pattern> listSet = new HashSet<>();
    if (listString != null) {
        final String[] regexArray = listString.split(",\\s*");
        for (String regex : regexArray) {
            Pattern whitePattern = Pattern.compile(regex);
            listSet.add(whitePattern);
        }
    }
    return java.util.Collections.unmodifiableSet(listSet);
}

...

protected Class<?> resolveClass(ObjectStreamClass desc)
            throws IOException, ClassNotFoundException
{
    String name = desc.getName();
    logger.fine("resolveClass: resolving " + name);

    // From https://github.com/ikkisoft/SerialKiller by [email protected]

    //Enforce blacklist
    for (Pattern blackPattern : blacklistPatterns) {
        Matcher blackMatcher = blackPattern.matcher(name);
        if (blackMatcher.find()) {
            logger.warning("resolveClass: rejecting blacklisted class " + name);
            String msg = "[!] Blocked by blacklist '"
                    + blackPattern.pattern() + "'. Match found for '" + name + "'";
            throw new InvalidClassException(msg);
        }
    }

    //Enforce whitelist if it exists.
    if (! whitelistPatterns.isEmpty()) {
        boolean safeClass = false;
        for (Pattern whitePattern: whitelistPatterns) {
            Matcher whiteMatcher = whitePattern.matcher(name);
            if (whiteMatcher.find()) {
                safeClass = true;
                break;
            }
        }

        if (!safeClass) {
            logger.warning("resolveClass: rejecting class " + name + " not found in whitelist.");
            String msg = "[!] Blocked by whitelist. No match found for '" + name + "'";
            throw new InvalidClassException(msg);
        }
    }

    try {
        logger.fine("resolveClass: accepting class " + name);
        return Class.forName(name, false, latestUserDefinedLoader());
    } catch (ClassNotFoundException ex) {
        Class<?> cl = primClasses.get(name);
        if (cl != null) {
            return cl;
        } else {
            throw ex;
        }
    }
}

LogManager.getLogManager().reset();
SLF4JBridgeHandler.removeHandlersForRootLogger();
SLF4JBridgeHandler.install();
Logger.getLogger("global").setLevel(Level.FINEST);