The GitHub Actions job "Nightly Builds (1.7)" on pekko.git/main has failed. Run started by GitHub user pjfanning (triggered by pjfanning).
Head commit for run: cffd027b89937115ee9a6a7c5b9f8e37df53a6cd / PJ Fanning <[email protected]> fix: don't resolve a wire-supplied manifest class the serializer will not use (#3495) Motivation: Serialization.deserializeByteArray resolved the manifest string from the wire into a Class via dynamicAccess.getClassFor for every plain Serializer, without checking whether that serializer wants a type hint. Serializers.manifestFor shows a conforming peer only sends a manifest when includeManifest is true, so for a serializer declaring includeManifest = false the class name can only have come from a non-conforming or hostile sender - and the loaded class is then discarded. ByteArraySerializer and NullSerializer are bound by default and reachable by serializer id, so a peer could name any class on the classpath and have it loaded: a classpath-probing oracle, and metaspace and manifest-cache growth that is never released. Modification: Pass None to a plain Serializer that declares includeManifest = false instead of resolving the wire-supplied name, which is exactly what a conforming sender produces. Serializers that do ask for the hint are unchanged. Result: A peer can no longer drive class loading through a serializer that ignores the type hint. No behaviour change for conforming messages. Tests: - sbt "actor-tests/testOnly org.apache.pekko.serialization.WireManifestClassLoadingSpec" - new; the first case fails without this change with "Cannot find manifest class [com.example.NotOnTheClasspath]" - sbt "actor-tests/testOnly org.apache.pekko.serialization.SerializeSpec" - existing spec passes unchanged - sbt "actor/mimaReportBinaryIssues" - no issues References: Refs #3478 Report URL: https://github.com/apache/pekko/actions/runs/33457126723 With regards, GitHub Actions via GitBox --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
