[GH] (pekko/jackson17): Workflow run "Generate doc check" failed!

[GitBox <gi...@apache.org>]

The GitHub Actions job "Generate doc check" on pekko.git/jackson17 has failed.
Run started by GitHub user pjfanning (triggered by pjfanning).

Head commit for run:
06b70562a4abe98be32311a519a5bb73cac9e53d / PJ Fanning <pj...@users.noreply.github.com>
fix: resolve, check and parse manifests more carefully in the Jackson serializers (#3503)

Motivation:
Four issues in JacksonSerializer, all reachable from a wire manifest:

- The case object branch called getObjectFor before checkAllowedClass.
  getObjectFor reads the MODULE$ field, which initializes the class, so a
  manifest naming a class the allow list would reject ran that class's
  initializer on the way to being rejected.
- LZ4Meta.get checked for 4 remaining bytes and then read 8, so a 4 to 7
  byte payload beginning with the LZ4 magic raised BufferUnderflowException.
- parseManifest called toInt on whatever followed the last '#', so a
  non-numeric version raised NumberFormatException.
- isInAllowList evaluated isBoundToJacksonSerializer first, which calls
  serializerFor and raises (filling in a stack trace) for a class that is
  allowed only by prefix. checkAllowedClass runs on every fromBinary.

Modification:
Resolve the case object's class with getClassFor, which does not initialize,
run checkAllowedClass on it, and only then read the module field. Require 8
remaining bytes for an LZ4 header. Parse the manifest version with
toIntOption and report a bad one as NotSerializableException. Test the
prefix before the binding, which cannot throw. Applied to both
serialization-jackson and serialization-jackson3.

Result:
A rejected manifest no longer initializes the class it names, two malformed
manifests are reported as serialization failures rather than as unrelated
runtime exceptions, and the allow list check no longer builds an exception
per message on the prefix path. No change for manifests that were accepted
before.

Report URL: https://github.com/apache/pekko/actions/runs/33735075512

With regards,
GitHub Actions via GitBox


---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@pekko.apache.org
For additional commands, e-mail: notifications-help@pekko.apache.org