Rajesh Vakkalagadda created SPARK-58785:
-------------------------------------------
Summary: FilteredObjectInputStream.resolveClass has zero direct
test references.
Key: SPARK-58785
URL: https://issues.apache.org/jira/browse/SPARK-58785
Project: Spark
Issue Type: Test
Components: Spark Core
Affects Versions: 4.4.0
Reporter: Rajesh Vakkalagadda
FilteredObjectInputStream.java:42 resolveClass guards the launcher's local
socket protocol
(SPARK-20922) by allow-listing only java.lang.* and
org.apache.spark.launcher.*. It has zero
direct test references; a silent regression reopens arbitrary deserialization.
Proposed tests
Add FilteredObjectInputStreamSuite covering the allow-list:
- Allowed must round-trip: java.lang.String, java.lang.Integer,
LauncherProtocol.Hello / SetAppId
- Disallowed must throw IllegalArgumentException("Unexpected class in stream:
..."):
java.util.HashMap, java.util.ArrayList, java.io.File
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
