[
https://issues.apache.org/jira/browse/SPARK-58785?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel
]
Rajesh Vakkalagadda updated SPARK-58785:
----------------------------------------
Summary: Add tests for FilteredObjectInputStream resolveClass allow-list
(was: FilteredObjectInputStream.resolveClass has zero direct test references.)
> Add tests for FilteredObjectInputStream resolveClass allow-list
> ---------------------------------------------------------------
>
> Key: SPARK-58785
> URL: https://issues.apache.org/jira/browse/SPARK-58785
> Project: Spark
> Issue Type: Test
> Components: Spark Core
> Affects Versions: 4.4.0
> Reporter: Rajesh Vakkalagadda
> Priority: Minor
>
> FilteredObjectInputStream.resolveClass has zero direct test references.
> FilteredObjectInputStream.java:42 resolveClass guards the launcher's local
> socket protocol
> (SPARK-20922) by allow-listing only java.lang.* and
> org.apache.spark.launcher.*. It has zero
> direct test references; a silent regression reopens arbitrary
> deserialization.
> Proposed tests
> Add FilteredObjectInputStreamSuite covering the allow-list:
> - Allowed must round-trip: java.lang.String, java.lang.Integer,
> LauncherProtocol.Hello / SetAppId
> - Disallowed must throw IllegalArgumentException("Unexpected class in
> stream: ..."):
> java.util.HashMap, java.util.ArrayList, java.io.File
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
