SEZ9 commented on PR #11557: URL: https://github.com/apache/seatunnel/pull/11557#issuecomment-5366244750
Thanks @DanielLeens — appreciate you going back to the source on this instead of just deferring. Your rebuttal on PR11557-F1 is convincing: the fields in `ManagedSourceRegisterOperation` are read/written through Hazelcast's typed `IdentifiedDataSerializable` machinery, `TaskDataSerializerHook.createFactory()` dispatches through a fixed switch so only enumerated classes can be instantiated, and the `readObject()` usage follows the existing convention in sibling operations like `SinkRegisterOperation`. That is materially different from JDK `ObjectInputStream` deserialization of attacker-chosen class names, so I agree this is not a HIGH-severity issue and I'm treating PR11557-F1 as resolved with the severity withdrawn. One small, non-blocking suggestion: add a brief comment on the read/write methods (or the class javadoc) noting that deserialization is factory-scoped via `TaskDataSerializerHook`, so this doesn't get re-flagged in future reviews. Since the head is still `e62beaaadf98132b7058f6f39de83238f4cfcb5e`, either leaving it as-is or a small comment-only commit works for me. <!-- streview-comment:424 --> -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
