[
https://issues.apache.org/jira/browse/RATIS-2659?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel
]
Tsz-wo Sze updated RATIS-2659:
------------------------------
Description:
bq. Java : how to securely read an object from network using ObjectInputStream
to avoid remote code execution?
According to Google AI responding to the question above, we should use
ObjectInputFilter in IOUtils.readObject(..).
(Thanks Qing Xu for reporting the problem of using ObjectInputStream!)
!image-2026-08-15-14-15-40-413.png|width=600!
was:
> Java : how to securely read an object from network using ObjectInputStream to
> avoid remote code execution?
According to Google AI responding to the question above, we should use
ObjectInputFilter in IOUtils.readObject(..).
!image-2026-08-15-14-15-40-413.png|width=600!
> IOUtils.readObject(..) should set ObjectInputFilter
> ---------------------------------------------------
>
> Key: RATIS-2659
> URL: https://issues.apache.org/jira/browse/RATIS-2659
> Project: Ratis
> Issue Type: Improvement
> Components: util
> Reporter: Tsz-wo Sze
> Assignee: Tsz-wo Sze
> Priority: Major
> Attachments: image-2026-08-15-14-15-40-413.png
>
>
> bq. Java : how to securely read an object from network using
> ObjectInputStream to avoid remote code execution?
> According to Google AI responding to the question above, we should use
> ObjectInputFilter in IOUtils.readObject(..).
> (Thanks Qing Xu for reporting the problem of using ObjectInputStream!)
> !image-2026-08-15-14-15-40-413.png|width=600!
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
