pjfanning opened a new pull request, #3517: URL: https://github.com/apache/pekko/pull/3517
cherry pick 67c3b557e538416fe55b9cbe3745817dbb4b6413 #3503 Motivation: Four issues in JacksonSerializer, all reachable from a wire manifest: - The case object branch called getObjectFor before checkAllowedClass. getObjectFor reads the MODULE$ field, which initializes the class, so a manifest naming a class the allow list would reject ran that class's initializer on the way to being rejected. - LZ4Meta.get checked for 4 remaining bytes and then read 8, so a 4 to 7 byte payload beginning with the LZ4 magic raised BufferUnderflowException. - parseManifest called toInt on whatever followed the last '#', so a non-numeric version raised NumberFormatException. - isInAllowList evaluated isBoundToJacksonSerializer first, which calls serializerFor and raises (filling in a stack trace) for a class that is allowed only by prefix. checkAllowedClass runs on every fromBinary. Modification: Resolve the case object's class with getClassFor, which does not initialize, run checkAllowedClass on it, and only then read the module field. Require 8 remaining bytes for an LZ4 header. Parse the manifest version with toIntOption and report a bad one as NotSerializableException. Test the prefix before the binding, which cannot throw. Applied to both serialization-jackson and serialization-jackson3. Result: A rejected manifest no longer initializes the class it names, two malformed manifests are reported as serialization failures rather than as unrelated runtime exceptions, and the allow list check no longer builds an exception per message on the prefix path. No change for manifests that were accepted before. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
