You are viewing a plain text version of this content. The canonical link for it is here.
Posted to issues@ratis.apache.org by "Tsz-wo Sze (Jira)" <ji...@apache.org> on 2026/09/15 17:24:00 UTC
[jira] [Updated] (RATIS-2659) IOUtils.readObject(..) should filter classes
[ https://issues.apache.org/jira/browse/RATIS-2659?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ]
Tsz-wo Sze updated RATIS-2659:
------------------------------
Description:
{quote}Java : how to securely read an object from network using ObjectInputStream to avoid remote code execution?
{quote}
- According to Google AI responding to the question above, we should use ObjectInputFilter in IOUtils.readObject(..). Unfortunately, ObjectInputFilter is added to Java 9 but not in Java 8.
- Therefore, we will create our own filter by extending ObjectInputStream and overriding the resolveClass(..) method. (Suggested by Claude)
- For compatibility, we have to support the current format for awhile before changing it to a safer format such as JSON.
Note that this is not a security vulnerability in Ratis since Ratis is a library. Applications using Ratis should enforce security (such as [using TLS|https://github.com/apache/ratis/blob/master/ratis-docs/src/site/markdown/security.md]) if it is needed.
(Thanks Qing Xu for reporting the problem of using ObjectInputStream!)
!image-2026-08-15-14-15-40-413.png|width=600!
was:
{quote}Java : how to securely read an object from network using ObjectInputStream to avoid remote code execution?
{quote}
According to Google AI responding to the question above, we should use ObjectInputFilter in IOUtils.readObject(..). For compatibility, we have to support the current format for awhile before changing it to a safer format such as JSON.
Note that this is not a security vulnerability in Ratis since Ratis is a library. Applications using Ratis should enforce security (such as [using TLS|https://github.com/apache/ratis/blob/master/ratis-docs/src/site/markdown/security.md]) if it is needed.
(Thanks Qing Xu for reporting the problem of using ObjectInputStream!)
!image-2026-08-15-14-15-40-413.png|width=600!
Summary: IOUtils.readObject(..) should filter classes (was: IOUtils.readObject(..) should set ObjectInputFilter)
> IOUtils.readObject(..) should filter classes
> --------------------------------------------
>
> Key: RATIS-2659
> URL: https://issues.apache.org/jira/browse/RATIS-2659
> Project: Ratis
> Issue Type: Improvement
> Components: util
> Reporter: Tsz-wo Sze
> Assignee: Tsz-wo Sze
> Priority: Major
> Attachments: image-2026-08-15-14-15-40-413.png
>
> Time Spent: 10m
> Remaining Estimate: 0h
>
> {quote}Java : how to securely read an object from network using ObjectInputStream to avoid remote code execution?
> {quote}
> - According to Google AI responding to the question above, we should use ObjectInputFilter in IOUtils.readObject(..). Unfortunately, ObjectInputFilter is added to Java 9 but not in Java 8.
> - Therefore, we will create our own filter by extending ObjectInputStream and overriding the resolveClass(..) method. (Suggested by Claude)
> - For compatibility, we have to support the current format for awhile before changing it to a safer format such as JSON.
> Note that this is not a security vulnerability in Ratis since Ratis is a library. Applications using Ratis should enforce security (such as [using TLS|https://github.com/apache/ratis/blob/master/ratis-docs/src/site/markdown/security.md]) if it is needed.
> (Thanks Qing Xu for reporting the problem of using ObjectInputStream!)
> !image-2026-08-15-14-15-40-413.png|width=600!
--
This message was sent by Atlassian Jira
(v8.20.10#820010)