oscerd opened a new pull request, #7254: URL: https://github.com/apache/incubator-kie/pull/7254
Closes https://github.com/apache/incubator-kie/issues/7253 Process variable values that are stored with Java serialization, through `ProtobufObjectMarshallerStrategy` (the fallback strategy) or `SerializableProtostreamBaseMarshaller` (`kogito.Serializable`, which includes `java.lang.Object` variables since #7151), are read back with `JavaSerializationUtils.deserialize`. This PR makes that method use the same class allowlist as Drools session marshalling. **Changes** `JavaSerializationUtils.deserialize` sets an `ObjectInputFilter` on the stream when `drools.serialization.enableDeserializationFilter` is `true`, the default. The filter accepts: - the classes `DeserializationFilterHelper.isClassAllowed` accepts: the `java.lang`, `java.util`, `java.math` and `java.time` packages, and the patterns in `drools.serialization.allowedDeserializationClassPatterns`; - `java.sql.Date`, `java.sql.Time` and `java.sql.Timestamp`, which are supported process variable types (`ProcessInstanceMarshallTest` round-trips a `Timestamp`); - `ProcessWorkItemHandlerException` and its `HandlingStrategy`, which `WorkItemNodeInstance` stores in the `Error` variable of a work item error handling process; - primitives, and arrays of any of the above. Any other class is rejected with an `InvalidClassException`, and a warning names the class and the property to set. A JVM-wide `jdk.serialFilter`, when set, stays in force: the two filters are merged. `process-serialization-protobuf` now declares `drools-core`, which it already got through `process-workitems`. **Upgrade note** Applications that keep their own classes in process variables through Java serialization need to allow them, for example: ``` -Ddrools.serialization.allowedDeserializationClassPatterns=com.example.model.* ``` Patterns are separated by `;`. The same applies to the cause of a `ProcessWorkItemHandlerException` kept by an error handling process that waits: a cause outside the allowlist has to be added. `-Ddrools.serialization.enableDeserializationFilter=false` turns the filter off, for Drools and process variables alike. The build-time warnings added for `java.lang.Object` variables in #7151 (`ModelMetaData`, `WorkItemModelMetaData`, `AbstractProtoGenerator`, `ReflectionProtoGenerator`) still only say to make the stored value `java.io.Serializable`. I can extend them to mention the property here or in a follow-up, whichever you prefer. **Tests** - `JavaSerializationUtilsTest`: JDK value types, including the `java.sql` ones, a map of lists and arrays, still round-trip by default, and so does a `ProcessWorkItemHandlerException`; a class outside the allowlist is rejected, on its own, inside a list, as an array and as the cause of a `ProcessWorkItemHandlerException`; a configured pattern allows it; the filter can be turned off. - `ProtobufObjectMarshallerStrategyTest` and `SerializableProtostreamBaseMarshallerTest` (new): the same through each caller. - `ProcessInstanceMarshallTest` and the existing `JavaSerializationUtilsTest` cases allow their own test classes through the property, as the Drools tests do with `DeserializationFilterTestSupport`. - `jbpm-tests`: its in-memory process store marshals instances with the default strategies, so its test model classes in `org.jbpm.bpmn2.objects` go through Java serialization. The module's surefire configuration allows that package. Run locally: `process-serialization-protobuf` and `jbpm-tests` (`make dev mvn -- install`), the persistence add-ons' unit tests (filesystem, rocksdb, mongodb), `integration-tests-quarkus-processes-filesystem` and `integration-tests-springboot-processes-jdbc`. _Claude Code on behalf of oscerd_ 🤖 Generated with [Claude Code](https://claude.com/claude-code) -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
