code: @Override
      protected Class<?> resolveClass(ObjectStreamClass desc) throws IOException, ClassNotFoundException {
          if (!this.expected.contains(desc.getName())) {
              throw new InvalidClassException("Unexpected deserialization ", desc.getName());
          }
          return super.resolveClass(desc);
      }
docs: {@inheritDoc}
  
  Only deserialize instances of expected classes by validating the class name prior to deserialization.