pjfanning opened a new pull request, #3518:
URL: https://github.com/apache/pekko/pull/3518
### Motivation
Backport of #3505 to 1.7.x: deserializing a message no longer resolves HOCON
`include`
directives, which gave a peer a blind SSRF primitive and forced reads of
local files and
classpath resources — reachable from `InitJoin` before the sender is a
cluster member.
### Modification
Cherry-pick of f7b0115d37, adapted for 1.7.x:
- `WireConfigSpec` imports `pekko.util.ccompat.JavaConverters` instead of
`scala.jdk.CollectionConverters`, which 1.7.x provides only for Scala
2.13+.
- Interpolated strings containing `\"` rewritten with triple quotes — that
escape only
became valid inside interpolations in Scala 2.13.6, so it does not parse
on 2.12.
- Import-block conflicts in `MiscMessageSerializer` and the two touched
specs resolved
against the 1.7.x import style.
### Result
Same as #3505: includes in wire config resolve to nothing; concise-rendered
config from
well-behaved senders is unaffected.
### Tests
- `sbt "++ 2.12.21 actor-tests/Test/compile" "++ 2.12.21
cluster/Test/compile" "++ 2.12.21 remote/Test/compile"` — clean, validating the
Scala 2.12 adaptations
- scalafmt run on the touched modules — only the cherry-picked files
reformatted
- Test suites intentionally left to CI per the release-prep flow; the tests
themselves are
the ones reviewed and merged in #3505
### References
Backport of #3505.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
