This is an automated email from the ASF dual-hosted git repository. rmaucher pushed a commit to branch 10.1.x in repository https://gitbox.apache.org/repos/asf/tomcat.git
commit 21021ff89ed40364f3825fa48c07ac4eee768dd8 Author: opencode <[email protected]> AuthorDate: Sun Oct 18 13:00:33 2026 +0200 Pin serialVersionUID in EL expression classes MethodExpressionImpl, ValueExpressionImpl and MethodExpressionLiteral are Externalizable classes that, per the jakarta.el Expression contract, are intended to be serialized to preserve expression state across the application lifetime. Unlike their sibling classes (ValueExpressionLiteral, FunctionMapperImpl, VariableMapperImpl, all of which are reachable in the same serialized streams and all of which have long pinned a serialVersionUID), these three relied on the JVM-computed default UID, which changes whenever the class structure changes, making cross-version deserialization fragile. Add @Serial private static final long serialVersionUID = 1L to each class, aligning them with the existing package convention. Verified that same-version serialization round-trips of all four expression classes continue to work and that the EL testsuite passes unchanged. --- java/org/apache/el/MethodExpressionImpl.java | 4 ++++ java/org/apache/el/MethodExpressionLiteral.java | 4 ++++ java/org/apache/el/ValueExpressionImpl.java | 4 ++++ 3 files changed, 12 insertions(+) diff --git a/java/org/apache/el/MethodExpressionImpl.java b/java/org/apache/el/MethodExpressionImpl.java index 190e281aef..00c1ee7fcb 100644 --- a/java/org/apache/el/MethodExpressionImpl.java +++ b/java/org/apache/el/MethodExpressionImpl.java @@ -20,6 +20,7 @@ import java.io.Externalizable; import java.io.IOException; import java.io.ObjectInput; import java.io.ObjectOutput; +import java.io.Serial; import jakarta.el.ELContext; import jakarta.el.ELException; @@ -67,6 +68,9 @@ import org.apache.el.util.ReflectionUtil; */ public final class MethodExpressionImpl extends MethodExpression implements Externalizable { + @Serial + private static final long serialVersionUID = 1L; + private Class<?> expectedType; private String expr; diff --git a/java/org/apache/el/MethodExpressionLiteral.java b/java/org/apache/el/MethodExpressionLiteral.java index 09846c7b99..182ae8e02f 100644 --- a/java/org/apache/el/MethodExpressionLiteral.java +++ b/java/org/apache/el/MethodExpressionLiteral.java @@ -20,6 +20,7 @@ import java.io.Externalizable; import java.io.IOException; import java.io.ObjectInput; import java.io.ObjectOutput; +import java.io.Serial; import java.lang.annotation.Annotation; import jakarta.el.ELContext; @@ -37,6 +38,9 @@ import org.apache.el.util.ReflectionUtil; */ public class MethodExpressionLiteral extends MethodExpression implements Externalizable { + @Serial + private static final long serialVersionUID = 1L; + private static final Annotation[] EMPTY_ANNOTATION_ARRAY = new Annotation[0]; private static final Object[] EMPTY_OBJECT_ARRAY = new Object[0]; diff --git a/java/org/apache/el/ValueExpressionImpl.java b/java/org/apache/el/ValueExpressionImpl.java index 67fc44aca1..a6a46c3321 100644 --- a/java/org/apache/el/ValueExpressionImpl.java +++ b/java/org/apache/el/ValueExpressionImpl.java @@ -20,6 +20,7 @@ import java.io.Externalizable; import java.io.IOException; import java.io.ObjectInput; import java.io.ObjectOutput; +import java.io.Serial; import jakarta.el.ELContext; import jakarta.el.ELException; @@ -74,6 +75,9 @@ import org.apache.el.util.ReflectionUtil; */ public final class ValueExpressionImpl extends ValueExpression implements Externalizable { + @Serial + private static final long serialVersionUID = 1L; + private Class<?> expectedType; private String expr; --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
