Rajesh Vakkalagadda created SPARK-59544:
-------------------------------------------
Summary: Tighten FilteredObjectInputStream.resolveClass to an
exact-package match
Key: SPARK-59544
URL: https://issues.apache.org/jira/browse/SPARK-59544
Project: Spark
Issue Type: Improvement
Components: Spark Core
Affects Versions: 4.4.0
Reporter: Rajesh Vakkalagadda
resolveClass's ALLOWED_PACKAGES check uses startsWith, which over-admits
subpackages of both allow-listed prefixes (e.g. java.lang.reflect.,
org.apache.spark.launcher. subpackages) beyond SPARK-20922's stated "just two
packages" intent. Documented andpinned by tests in
FilteredObjectInputStreamSuite (SPARK-58785). Optionally also track the missing
ObjectInputFilter maxarray/maxrefs/maxdepth DoS limits here.
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
