Copilot commented on code in PR #8120:
URL: https://github.com/apache/incubator-seata/pull/8120#discussion_r3331271550
##########
json-common/json-common-core/src/main/java/org/apache/seata/common/json/JsonAllowlistManager.java:
##########
@@ -107,10 +111,18 @@ public void addUserPrefix(String prefix) {
* Check if a class is allowed for deserialization
*/
public boolean isAllowed(String className) {
- if (className == null) {
+ if (className == null || className.length() > MAX_CLASS_NAME_LENGTH) {
return false;
}
- return cache.computeIfAbsent(className, this::doCheck);
+ if (cache.get(className) != null) {
Review Comment:
The new length guard prevents overlong names from entering the cache, but
callers that use `checkClass` still include the full rejected value in the
`SecurityException` message. Since the serializer validators call `checkClass`
on untrusted type names, an oversized name can still force
allocation/propagation of a very large exception message; truncate the name
when reporting the failure.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
