davsclaus commented on code in PR #26009: URL: https://github.com/apache/camel/pull/26009#discussion_r3904659283
########## core/camel-support/src/main/java/org/apache/camel/support/KeyValueRepositoryHelper.java: ########## @@ -0,0 +1,125 @@ +/* + * Licensed to the Apache Software Foundation (ASF) under one or more + * contributor license agreements. See the NOTICE file distributed with + * this work for additional information regarding copyright ownership. + * The ASF licenses this file to You under the Apache License, Version 2.0 + * (the "License"); you may not use this file except in compliance with + * the License. You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ +package org.apache.camel.support; + +import java.io.ByteArrayInputStream; +import java.io.ByteArrayOutputStream; +import java.io.IOException; +import java.io.ObjectInputStream; +import java.io.ObjectOutputStream; +import java.nio.ByteBuffer; + +import org.apache.camel.RuntimeCamelException; + +/** + * Shared serialization utilities for {@link org.apache.camel.spi.KeyValueRepository} implementations. + * <p/> + * All persistent {@code KeyValueRepository} implementations need to serialize arbitrary Java objects to bytes (for BLOB + * columns, Kafka messages, etc.) and deserialize them back. This helper centralises that logic to avoid the same + * try/catch boilerplate in every implementation. + * <p/> + * <b>Security note:</b> These methods use plain Java serialization + * ({@link ObjectOutputStream}/{@link ObjectInputStream}). The stored data is trusted — it was written by the same + * application instance or cluster. Do not expose a repository's raw byte store to untrusted input. + * + * @since 4.23 + */ +public final class KeyValueRepositoryHelper { + + private KeyValueRepositoryHelper() { + // utility class + } + + /** + * Serializes an object to a byte array using Java object serialization. + * + * @param value the object to serialize (must be {@link java.io.Serializable}) + * @return the serialized bytes + * @throws RuntimeCamelException if serialization fails + */ + public static byte[] serialize(Object value) { Review Comment: Do we really need any kind of java object serialization - that is causing freaking much CVEs and headache. The world stopped storing java objects on disk. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
