oscerd opened a new issue, #7253: URL: https://github.com/apache/incubator-kie/issues/7253
### Description When a process instance is persisted, `kogito-jbpm/process-serialization-protobuf` stores some process variable values with Java serialization: - `ProtobufObjectMarshallerStrategy`, the fallback strategy for values that no other `ObjectMarshallerStrategy` handles; - `SerializableProtostreamBaseMarshaller`, for values mapped to the `kogito.Serializable` protostream type, which since #7150 includes `java.lang.Object` variables. Both read the bytes back with `JavaSerializationUtils.deserialize`, which does not apply the class allowlist that Drools session marshalling uses. In Drools, `SerializablePlaceholderResolverStrategy`, `JavaSerializableResolverStrategy` and `JPAPlaceholderResolverStrategy` set the `ObjectInputFilter` built by `org.drools.core.util.DeserializationFilterHelper`, controlled by the `drools.serialization.enableDeserializationFilter` and `drools.serialization.allowedDeserializationClassPatterns` system properties. Process variables should follow the same rules, so that Java-serialized data is read with one allowlist and one set of properties across the engines. ### Implementation ideas - Set an `ObjectInputFilter` in `JavaSerializationUtils.deserialize` when `DeserializationFilterHelper.isDeserializationFilterEnabled()` returns true (the default). - Accept what `DeserializationFilterHelper.isClassAllowed` accepts (the `java.lang`, `java.util`, `java.math` and `java.time` packages, and the configured patterns), plus `java.sql.Date`, `java.sql.Time` and `java.sql.Timestamp`, which are supported process variable types (`ProcessInstanceMarshallTest` covers `Timestamp`), and `ProcessWorkItemHandlerException`, which `WorkItemNodeInstance` stores in the `Error` variable of a work item error handling process. - Keep a JVM-wide `jdk.serialFilter`, when one is set, in force. - Applications that keep their own classes in process variables through Java serialization add them with `-Ddrools.serialization.allowedDeserializationClassPatterns=com.example.model.*`. `-Ddrools.serialization.enableDeserializationFilter=false` turns the filter off. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
