This is an automated email from the ASF dual-hosted git repository. rzo1 pushed a commit to branch master in repository https://gitbox.apache.org/repos/asf/storm.git
commit 7c439567639a06b01b41da4005602e2e9f47383b Author: Richard Zowalla <[email protected]> AuthorDate: Thu Apr 2 11:20:22 2026 +0200 Refactor ClientAuthUtils: Add try-with-resources for proper stream cleanup, add null guards on public API entry points, and apply final to parameters and local variables. --- .../storm/security/auth/ClientAuthUtils.java | 53 ++++++++++++++-------- 1 file changed, 34 insertions(+), 19 deletions(-) diff --git a/storm-client/src/jvm/org/apache/storm/security/auth/ClientAuthUtils.java b/storm-client/src/jvm/org/apache/storm/security/auth/ClientAuthUtils.java index 7b319cea0..4472960bc 100644 --- a/storm-client/src/jvm/org/apache/storm/security/auth/ClientAuthUtils.java +++ b/storm-client/src/jvm/org/apache/storm/security/auth/ClientAuthUtils.java @@ -22,6 +22,7 @@ import java.io.ByteArrayInputStream; import java.io.ByteArrayOutputStream; import java.io.File; import java.io.IOException; +import java.io.ObjectInputFilter; import java.io.ObjectInputStream; import java.io.ObjectOutputStream; import java.net.URI; @@ -512,34 +513,48 @@ public class ClientAuthUtils { - public static byte[] serializeKerberosTicket(KerberosTicket tgt) throws Exception { - ByteArrayOutputStream bao = new ByteArrayOutputStream(); - ObjectOutputStream out = new ObjectOutputStream(bao); - out.writeObject(tgt); - out.flush(); - out.close(); - return bao.toByteArray(); + public static byte[] serializeKerberosTicket(final KerberosTicket tgt) throws Exception { + if (tgt == null) { + throw new IllegalArgumentException("KerberosTicket must not be null"); + } + try (ByteArrayOutputStream bao = new ByteArrayOutputStream(); + ObjectOutputStream out = new ObjectOutputStream(bao)) { + out.writeObject(tgt); + out.flush(); + return bao.toByteArray(); + } } - public static KerberosTicket deserializeKerberosTicket(byte[] tgtBytes) { - KerberosTicket ret; - try { - - ByteArrayInputStream bin = new ByteArrayInputStream(tgtBytes); - ObjectInputStream in = new ObjectInputStream(bin); - ret = (KerberosTicket) in.readObject(); - in.close(); - } catch (Exception e) { + public static KerberosTicket deserializeKerberosTicket(final byte[] tgtBytes) { + if (tgtBytes == null) { + throw new IllegalArgumentException("Kerberos ticket bytes must not be null"); + } + final ObjectInputFilter filter = + ObjectInputFilter.Config.createFilter( + "javax.security.auth.kerberos.*;" + + "java.net.InetAddress;" + + "java.net.Inet4Address;" + + "java.net.Inet6Address;" + + "[Ljava.net.InetAddress;" + + "java.util.Date;" + + "[B;" // byte[] + + "[Z;" // boolean[] + + "!*" // reject everything else + ); + try (ByteArrayInputStream bin = new ByteArrayInputStream(tgtBytes); + ObjectInputStream in = new ObjectInputStream(bin)) { + in.setObjectInputFilter(filter); + return (KerberosTicket) in.readObject(); + } catch (final Exception e) { throw new RuntimeException(e); } - return ret; } - public static KerberosTicket cloneKerberosTicket(KerberosTicket kerberosTicket) { + public static KerberosTicket cloneKerberosTicket(final KerberosTicket kerberosTicket) { if (kerberosTicket != null) { try { return (deserializeKerberosTicket(serializeKerberosTicket(kerberosTicket))); - } catch (Exception e) { + } catch (final Exception e) { throw new RuntimeException("Failed to clone KerberosTicket TGT!!", e); } }
