sunchao commented on code in PR #58620: URL: https://github.com/apache/spark/pull/58620#discussion_r3963648363
########## core/src/main/scala/org/apache/spark/serializer/JavaSerializer.scala: ########## @@ -85,6 +88,11 @@ private[spark] class JavaDeserializationStream(in: InputStream, loader: ClassLoa } + // A JEP-290 deserialization filter for callers that validate persisted data on read + // (e.g. the master recovery store). Applied per-stream so it cannot affect other + // JavaSerializer users. + filter.foreach(objIn.setObjectInputFilter) Review Comment: [P2] Preserve existing JVM deserialization restrictions When a master already has `jdk.serialFilter` configured, this call replaces the stream's existing JVM filter under the default JDK filter factory. ZooKeeper recovery previously inherited that policy; after this change, existing class restrictions and array/depth limits are silently discarded even with the new Spark setting left at its default. The [JDK contract](https://docs.oracle.com/en/java/javase/17/docs/api/java.base/java/io/ObjectInputFilter.Config.html#getSerialFilterFactory()) explicitly documents this replacement behavior. I verified the difference through `ZooKeeperPersistenceEngine`: with `jdk.serialFilter=maxarray=1`, the same harmless two-byte array is rejected on the merge base and recovered on this head. This used the respective changed sources compiled against cached Spark dependencies, rather than a clean full build. Please compose the recovery filter with `objIn.getObjectInputFilter` so rejection by either policy is preserved. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
