nishat-06 opened a new pull request, #8689:
URL: https://github.com/apache/hadoop/pull/8689
### Description of PR
`ResourceMappings.AssignedResources.fromBytes` reads the per-container
assigned-resource record with `SerializationUtils.deserialize`, which is a bare
`ObjectInputStream.readObject()` with no type restriction:
resources = SerializationUtils.deserialize(bytes);
`NMLeveldbStateStoreService.loadContainerState` hands it the bytes stored
under the container's `assigned-resources` key and replays them during
container recovery on NM restart. A tampered recovery record can therefore
instantiate any serializable class on the NodeManager classpath, not just the
resource descriptors this code stores.
The read is switched to a commons-io `ValidatingObjectInputStream`
restricted to the types the resource plugins actually write: the gpu/fpga/numa
value objects under the nodemanager package, the shaded-guava `ImmutableMap`
that `NumaResourceAllocation` holds, and the wrapping collections/strings.
`toBytes` is left as-is so records written by earlier NMs still recover.
### How was this patch tested?
`mvn test -pl hadoop-yarn-project/.../hadoop-yarn-server-nodemanager
-Dtest=TestResourceMappings` on trunk. Added a round-trip test over
`GpuDevice`, `FpgaDevice`, `NumaResourceAllocation` and `String` so valid
records still deserialize, plus a test that a record carrying an element type
the plugins never store is rejected instead of instantiated.
### For code changes:
- [ ] Does the title of this PR start with the corresponding JIRA issue id
(e.g. 'HADOOP-17799. Your PR title ...')?
- [ ] Object storage: Have the integration tests been executed and the
endpoint declared according to the connector-specific documentation?
- [ ] If adding new dependencies to the code, are these dependencies
licensed in a way that is compatible for inclusion under [ASF
2.0](http://www.apache.org/legal/resolved.html#category-a)?
- [ ] If applicable, have you updated the `LICENSE`, `LICENSE-binary`,
`NOTICE-binary` files?
### AI Tooling
If an AI tool was used:
- [ ] The PR includes the phrase "Contains content generated by <tool>"
where <tool> is the name of the AI tool used.
- [ ] My use of AI contributions follows the ASF legal policy
https://www.apache.org/legal/generative-tooling.html
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
