SEZ9 commented on PR #11557: URL: https://github.com/apache/seatunnel/pull/11557#issuecomment-6160291190
Follow-up on the F1 (unsafe deserialization in `ManagedSourceRegisterOperation`) item: The executed evidence on `b00c3e0cdad` is what I was waiting for — `ManagedSourceRegisterOperationSerializationTest` running 2 tests with 0 failures/errors/skips in the JDK 8 Ubuntu job (run `37762848399`, job `113270515885`) covers the valid round trip and the same-factory/different-class payload rejection, which is the core of this finding. The linked follow-up issue for the untyped `readObject()` paths in `AssignSplitOperation` / `TaskOperation` is the right way to keep that legacy work out of this PR. Two remaining asks before I consider F1 closed: 1. The head has since moved to `5dc655e6a91` and the Build run `38352742729` is still queued. Please post the executed result of `ManagedSourceRegisterOperationSerializationTest` from that run once it completes, so the evidence matches the head that would actually be merged rather than the previous one. 2. Please confirm explicitly that `testMismatchedReaderLocationTypeIsRejected` is one of the 2 tests reported in that job — the summary mentions the test class count but not the individual test name. Once those are in, I'm fine with F1. <!-- streview-comment:1743 --> -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
