L1nq0 commented on code in PR #9075:
URL: https://github.com/apache/storm/pull/9075#discussion_r3946580405
##########
storm-client/src/jvm/org/apache/storm/serialization/SerializableSerializer.java:
##########
@@ -48,6 +65,9 @@ public Object read(Kryo kryo, Input input, Class c) {
ByteArrayInputStream bis = new ByteArrayInputStream(ser);
try {
ObjectInputStream ois = new ObjectInputStream(bis);
+ if (serialFilter != null) {
+ ois.setObjectInputFilter(serialFilter);
Review Comment:
Implemented exactly as suggested, pushed as 54e4926, factored into a
package-private helper so the semantics are unit-testable:
```
static ObjectInputFilter mergeWithExisting(ObjectInputFilter configured,
ObjectInputFilter existing) {
return existing != null ? ObjectInputFilter.merge(configured, existing)
: configured;
}
```
I checked the composition rules against the JDK 25 ObjectInputFilter.merge
javadoc: a REJECTED from either side rejects, otherwise an ALLOWED from either
allows, otherwise UNDECIDED. Limits are not merged into a composite value: each
pattern filter checks its own limits against the real FilterInfo, so the merge
keeps the smaller limit, which matches what you described. The unit tests cover
the null case, a denial from either side, and the tighter limit winning. I did
not add a JVM-wide end-to-end test: jdk.serialFilter is process-global and
effectively set-once for a surefire JVM, so mutating it would poison unrelated
tests in the same fork; your JDK 25 check already covers this at runtime.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
