gosonzhang commented on issue #9613: URL: https://github.com/apache/inlong/issues/9613#issuecomment-2123728211
Based on the premise that we will not access untrusted external services through an SDK, we can make a simple modification to this problem for now: in the unwrapException function, only construct objects for clazz that belong to the Throwable class or its subclasses, to avoid Remote Code Execution (RCE) issues. In the future, we can consider adjusting the interaction protocol between the SDK and the Server to avoid object construction on the SDK side. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
