DanielLeens commented on PR #11559:
URL: https://github.com/apache/seatunnel/pull/11559#issuecomment-6166326198
Thanks @SEZ9, both asks are fair. Here are the pointers, verified against
the PR head `522bedc2d25`.
**1. Where the code and tests live**
- The visibility change and the second rejection test were added together in
commit `8909a67fce2` ("Cover exact-name Kafka gate split allowlist without
reflection"): https://github.com/apache/seatunnel/pull/11559/commits/8909a67fce2
- Production side, `KafkaSourceReader.java:404`: `deserializeSplit(byte[])`
is now package-private `static` (it was `private static`). Its Javadoc states
it is only widened so tests can drive the real allowlist. The method is still
routed through `KafkaGateObjectInputStream`, whose `resolveClass` allows only
`[B`, `String`, `Long`, `Integer`, `KafkaSourceSplit`, `TopicPartition` and
`TablePath` by exact class name.
- `KafkaSourceReaderGateTest.java:133`
`productionDeserializeSplitShouldRoundTripKafkaSourceSplit` is the positive
path through the real method.
- `:144` `productionDeserializeSplitShouldRejectClassOutsideAllowlist` feeds
a `HashMap` payload and asserts the exact message `Rejected Kafka source gate
split class: java.util.HashMap`.
- `:168`
`productionDeserializeSplitShouldRejectSamePackageSubclassOutsideAllowlist`
feeds a serialized `KafkaSourceSplitState` (same package, name starts with
`KafkaSourceSplit`, and it would also satisfy the `instanceof KafkaSourceSplit`
guard). It is rejected only by exact-name matching, so widening
`isAllowedClass` to a prefix or package match turns this test red.
**2. Evidence tied to the head**
The 7-test results I linked earlier are on `522bedc2d25`, and that SHA is
still the PR head. I have not pushed anything to the Kafka reader or its test
since. If either changes, I will re-link the job results for the new head
before asking you to close PR11559-F1.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
