sjyangkevin commented on issue #52753: URL: https://github.com/apache/airflow/issues/52753#issuecomment-3104807729
Hi @bolkedebruin , thanks for the feedback. > I do not like to check for allowed_deserialize_classes here at all. It has the same concerns we discussed before @sjyangkevin as it circumvents the security check in the main code. The `allowed_deserialize_classes` is the type(s) generated from the `deserializers` list, which doesn’t take anything from the main code. It can be rewritten in a chain of if elif control flow for checking the `cls: type` passed from the main code is actually an identified deserializable object. Let me know if I understand your concern correctly or it’s still a concern related to `import_string`. > Both can be present as they are just there for serde to recognize if a particular (de)serializer is available. For the serializer to encounter a version 2 object but only having a version 1 numpy would be... weird and for the deserializer it could happen but is also a strange situation. I think it would align with “version 1” implementation, both `np.bool` and `np.bool_` are present in the serializers and deserializers list. This can resolve the issue at runtime (if numpy v1 is installed, then it detects np.bool_; if numpy v2 is installed, then it detects no.bool) but failed the test (static check). In numpy v1, the np.bool is considered deprecated and cannot be imported, or invoked directly. In v2, np.bool_ is considered an alias as np.bool and both are valid. I think we have two discussions here. 1. How to resolve the current issue. The current issue is because in the serializers we have only `np.bool_`. It works good when numpy version is 1.x. The whitelist checking in the main code `serde.py` take the qualified name of the object and check against the `serializers` list. In numpy v2, if that is installed in the airflow environment. The qualified name of np.bool or np.bool_ is resolved to `np.bool`, which is not in the serializers list. So, the object cannot match to any serializer and result in the error. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
