You are viewing a plain text version of this content. The canonical link for it is here.
Posted to issues@spark.apache.org by "Kousuke Saruta (Jira)" <ji...@apache.org> on 2026/10/22 13:16:00 UTC
[jira] [Resolved] (SPARK-58785) Add tests for FilteredObjectInputStream resolveClass allow-list
[ https://issues.apache.org/jira/browse/SPARK-58785?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ]
Kousuke Saruta resolved SPARK-58785.
------------------------------------
Fix Version/s: 4.2.2
4.1.5
4.0.6
4.3.1
4.4.0
Resolution: Fixed
Issue resolved by pull request 58016
[https://github.com/apache/spark/pull/58016]
> Add tests for FilteredObjectInputStream resolveClass allow-list
> ---------------------------------------------------------------
>
> Key: SPARK-58785
> URL: https://issues.apache.org/jira/browse/SPARK-58785
> Project: Spark
> Issue Type: Test
> Components: Spark Core, Tests
> Affects Versions: 4.4.0
> Reporter: Rajesh Vakkalagadda
> Assignee: Rajesh Vakkalagadda
> Priority: Minor
> Labels: pull-request-available
> Fix For: 4.2.2, 4.1.5, 4.0.6, 4.3.1, 4.4.0
>
>
> FilteredObjectInputStream.resolveClass has zero direct test references.
> FilteredObjectInputStream.java:42 resolveClass guards the launcher's local socket protocol
> (SPARK-20922) by allow-listing only java.lang.* and org.apache.spark.launcher.*. It has zero
> direct test references; a silent regression reopens arbitrary deserialization.
> Proposed tests
> Add FilteredObjectInputStreamSuite covering the allow-list:
> - Allowed must round-trip: java.lang.String, java.lang.Integer, LauncherProtocol.Hello / SetAppId
> - Disallowed must throw IllegalArgumentException("Unexpected class in stream: ..."):
> java.util.HashMap, java.util.ArrayList, java.io.File
--
This message was sent by Atlassian Jira
(v10.3.26#10030026)
---------------------------------------------------------------------
To unsubscribe, e-mail: issues-unsubscribe@spark.apache.org
For additional commands, e-mail: issues-help@spark.apache.org