@Override
  public StreamSerialFilter create(SerializableObjectConfig config, Set<String> sanctionedClasses) {
    ObjectInputFilterApi api =
        new ReflectiveObjectInputFilterApiFactory().createObjectInputFilterApi();

    if (config.getValidateSerializableObjects()) {
      String pattern = new SanctionedSerializablesFilterPattern()
          .append(config.getSerializableObjectFilter())
          .pattern();

      return new ReflectiveFacadeStreamSerialFilter(api, pattern, sanctionedClasses);
    }
    return new NullStreamSerialFilter();
  }
Creates an instance of {@code ObjectInputFilter} that delegates to {@code ObjectInputFilterApi}
to maintain independence from the JRE version.
geode-serialization/src/main/java/org/apache/geode/internal/serialization/filter/ReflectiveFacadeStreamSerialFilterFactory.java