DanielLeens opened a new issue, #12747: URL: https://github.com/apache/seatunnel/issues/12747
### Problem Follow-up from PR #11557 and the review discussion around Hazelcast typed reads. Two pre-existing task-operation paths do not explicitly validate the decoded wire type at the read site: - `AssignSplitOperation#readInternal` uses `taskID = in.readObject()` without checking the decoded value is a `TaskLocation`. - `TaskOperation#readInternal` uses `in.readObject(TaskLocation.class)`. For Hazelcast `DataSerializableSerializer`, the class argument is a construction override rather than validation of the wire factory/class id, so a mismatched payload can be consumed positionally into a new `TaskLocation`. ### Proposed scope - Decode through the public `ObjectDataInput` contract and reject `null` or non-`TaskLocation` values at the read site with a clear `IOException`. - Add a same-factory/different-class negative serialization test and a valid round-trip test for each path. - Preserve the existing serializer factory IDs, class IDs, and wire format for valid payloads. ### Context Tracked separately because both paths predate PR #11557 and are shared by legacy task operations. Review context: https://github.com/apache/seatunnel/pull/11557#issuecomment-6008751359 -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
