[
https://issues.apache.org/jira/browse/RATIS-2659?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel
]
Tsz-wo Sze updated RATIS-2659:
------------------------------
Description:
{quote}Java : how to securely read an object from network using
ObjectInputStream to avoid remote code execution?
{quote}
According to Google AI responding to the question above, we should use
ObjectInputFilter in IOUtils.readObject(..). For compatibility, we have to
support the current format for awhile before changing it to a safer format such
as JSON.
Note that this is not a security vulnerability in Ratis since Ratis is a
library. Applications using Ratis should enforce security (such as [using
TLS|https://github.com/apache/ratis/blob/master/ratis-docs/src/site/markdown/security.md])
if it is needed.
(Thanks Qing Xu for reporting the problem of using ObjectInputStream!)
!image-2026-08-15-14-15-40-413.png|width=600!
was:
bq. Java : how to securely read an object from network using ObjectInputStream
to avoid remote code execution?
According to Google AI responding to the question above, we should use
ObjectInputFilter in IOUtils.readObject(..). For compatibility, we have to
support the current format for awhile before changing it to another format such
as JSON.
Note that this is not a security vulnerability in Ratis since Ratis is a
library. Applications using Ratis should enforce security (such as [using
TLS|https://github.com/apache/ratis/blob/master/ratis-docs/src/site/markdown/security.md])
if it is needed.
(Thanks Qing Xu for reporting the problem of using ObjectInputStream!)
!image-2026-08-15-14-15-40-413.png|width=600!
> IOUtils.readObject(..) should set ObjectInputFilter
> ---------------------------------------------------
>
> Key: RATIS-2659
> URL: https://issues.apache.org/jira/browse/RATIS-2659
> Project: Ratis
> Issue Type: Improvement
> Components: util
> Reporter: Tsz-wo Sze
> Assignee: Tsz-wo Sze
> Priority: Major
> Attachments: image-2026-08-15-14-15-40-413.png
>
>
> {quote}Java : how to securely read an object from network using
> ObjectInputStream to avoid remote code execution?
> {quote}
> According to Google AI responding to the question above, we should use
> ObjectInputFilter in IOUtils.readObject(..). For compatibility, we have to
> support the current format for awhile before changing it to a safer format
> such as JSON.
> Note that this is not a security vulnerability in Ratis since Ratis is a
> library. Applications using Ratis should enforce security (such as [using
> TLS|https://github.com/apache/ratis/blob/master/ratis-docs/src/site/markdown/security.md])
> if it is needed.
> (Thanks Qing Xu for reporting the problem of using ObjectInputStream!)
> !image-2026-08-15-14-15-40-413.png|width=600!
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
