You are viewing a plain text version of this content. The canonical link for it is here.
Posted to issues@commons.apache.org by "Akshat-coder2106 (via GitHub)" <gi...@apache.org> on 2025/12/15 00:51:06 UTC
[PR] [LANG-1734] Deprecate SerializationUtils.deserialize [commons-lang]
Akshat-coder2106 opened a new pull request, #1525:
URL: https://github.com/apache/commons-lang/pull/1525
Deprecates `SerializationUtils.deserialize` methods as requested in LANG-1734. These methods are unsafe when used with untrusted data. Users should use Java serialization filtering or safer alternatives.
- [x] Read the [contribution guidelines](CONTRIBUTING.md) for this project.
- [x] Read the [ASF Generative Tooling Guidance](https://www.apache.org/legal/generative-tooling.html) if you use Artificial Intelligence (AI).
- [ ] I used AI to create any part of, or all of, this pull request. Which AI tool was used to create this pull request, and to what extent did it contribute?
- [x] Run a successful build using the default [Maven](https://maven.apache.org/) goal with `mvn`; that's `mvn` on the command line by itself.
- [x] Write unit tests that match behavioral changes, where the tests fail if the changes to the runtime are not applied. This may not always be possible, but it is a best practice.
- [x] Write a pull request description that is detailed enough to understand what the pull request does, how, and why.
- [x] Each commit in the pull request should have a meaningful subject line and body. Note that a maintainer may squash commits during the merge process.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@commons.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] [LANG-1734] Deprecate SerializationUtils.deserialize [commons-lang]
Posted by "Akshat-coder2106 (via GitHub)" <gi...@apache.org>.
Akshat-coder2106 commented on PR #1525:
URL: https://github.com/apache/commons-lang/pull/1525#issuecomment-3652747922
Hi Gary, thank you for the review.
My apologies for overlooking the "Needs discussion" note in the JIRA ticket; that was my mistake.
Regarding the incomplete Javadoc: I understand we need to point users to a replacement. Since SerializationUtils does not have a direct alternative in this library, would you prefer I update the Javadoc to recommend using standard Java ObjectInputFilter (JEP 290) for secure deserialization?
Please let me know your preferred wording for the replacement, and I will update the PR immediately.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@commons.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] [LANG-1734] Deprecate SerializationUtils.deserialize [commons-lang]
Posted by "garydgregory (via GitHub)" <gi...@apache.org>.
garydgregory commented on PR #1525:
URL: https://github.com/apache/commons-lang/pull/1525#issuecomment-3652725878
-1 as this PR stands. The annotations and Javadoc tags are both mismatched and incomplete. What is the recommended replacement? I guess you didn't see the "Needs discussion" comment in the Jira ticket.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@commons.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] [LANG-1734] Deprecate SerializationUtils.deserialize [commons-lang]
Posted by "garydgregory (via GitHub)" <gi...@apache.org>.
garydgregory commented on PR #1525:
URL: https://github.com/apache/commons-lang/pull/1525#issuecomment-3655675331
I don't think we need to deprecate these APIs since our security model explicitly specifies that we expect trusted input. Instead we can point to Commons IO and its ValidatingInputStream for users who want to use more secure focused processing.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@commons.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] [LANG-1734] Deprecate SerializationUtils.deserialize [commons-lang]
Posted by "Akshat-coder2106 (via GitHub)" <gi...@apache.org>.
Akshat-coder2106 closed pull request #1525: [LANG-1734] Deprecate SerializationUtils.deserialize
URL: https://github.com/apache/commons-lang/pull/1525
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@commons.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] [LANG-1734] Deprecate SerializationUtils.deserialize [commons-lang]
Posted by "garydgregory (via GitHub)" <gi...@apache.org>.
garydgregory commented on PR #1525:
URL: https://github.com/apache/commons-lang/pull/1525#issuecomment-3656186182
@Akshat-coder2106
Thank you for helping make this component better.
In git master, I now document a safer deserialization option in Javadoc for this class. You are credited in `changes.xml`. I think you can close this PR unless you think the documentation can be further improved.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@commons.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] [LANG-1734] Deprecate SerializationUtils.deserialize [commons-lang]
Posted by "Akshat-coder2106 (via GitHub)" <gi...@apache.org>.
Akshat-coder2106 commented on PR #1525:
URL: https://github.com/apache/commons-lang/pull/1525#issuecomment-3658101494
Thank you, Gary! I appreciate you updating the Javadoc and crediting me in changes.xml. I am happy to see the security warning added.
I will close this PR now as the improvement is already merged.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@commons.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org