SEZ9 commented on PR #11557: URL: https://github.com/apache/seatunnel/pull/11557#issuecomment-5358314167
Thanks @DanielLeens for the disciplined re-verification, and for calling out your own corrections explicitly — retracting earlier over-reports rather than letting them linger in a blocker list is exactly the right move. I agree with your scope assessment: since `e62beaaadf98132b7058f6f39de83238f4cfcb5e` diffs empty against `2eb0e8378213a526a8d17b79c4c5c04084cb2aed` across the paths this PR owns, the head is a pure sync merge and nothing previously reported can have been resolved by it. Given that, a short re-derivation instead of re-posting the full report from review `4945122742` is the correct application of the review rule — no complaints about the brevity. That also means the finding I'm still tracking from my side remains open unchanged: the unsafe Java deserialization pattern in `seatunnel-engine/seatunnel-engine-server/src/main/java/org/apache/seatunnel/engine/server/task/operation/source/ManagedSourceRegisterOperation.java`. Since no managed-source-runtime file changed in this head, that code is byte-identical to what I flagged. This is a HIGH-severity security item and it needs an actual fix commit before this can move forward — an operation payload should not be reconstructed via unrestricted Java deserialization. Concrete remaining asks: 1. Push a commit that replaces the unsafe deserialization in `ManagedSourceRegisterOperation.java` with a safe, validated decoding path (or an explicitly constrained mechanism), rather than deserializing arbitrary payloads. 2. When that commit lands, note in the thread which head it applies to so the next review round can be scoped as cleanly as this one was. Happy to re-review promptly once a commit touching the managed-source-runtime files actually appears — as you noted, another sync merge won't change the state of the findings. <!-- streview-comment:404 --> -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
