You are viewing a plain text version of this content. The canonical link for it is here.

Posted to issues@commons.apache.org by "GracieleRodrigues-dev (via GitHub)" <gi...@apache.org> on 2024/11/27 22:56:05 UTC

[PR] Fix MC_OVERRIDABLE_METHOD_CALL_IN_READ_OBJECT in EventListenerSupport class [commons-lang]

GracieleRodrigues-dev opened a new pull request, #1319:
URL: https://github.com/apache/commons-lang/pull/1319

   This pull request addresses the issue identified by SpotBugs: **MC_OVERRIDABLE_METHOD_CALL_IN_READ_OBJECT** in the `readObject` method of the `EventListenerSupport` class. The bug relates to the use of the potentially overridable method `Thread.currentThread().getContextClassLoader()` during deserialization, which could lead to unexpected behavior or security risks in certain contexts.
   
   #### **Changes Made**
   1. **Introduced a static constant `DEFAULT_CLASS_LOADER`:**
      - The `ClassLoader` is captured at class initialization and stored in a static constant.
      - This ensures a consistent and safe `ClassLoader` is used throughout the deserialization process.
   
   2. **Replaced the call to `Thread.currentThread().getContextClassLoader`:**
      - The call inside the `readObject` method was replaced with the `DEFAULT_CLASS_LOADER` constant.
      - This eliminates the risk of calling a potentially overridden method during deserialization.
   
   3. **Added explanatory comments:**
      - Detailed comments were added to clarify the purpose of the changes and the reasoning behind the new approach.
   
   #### **Advantages**
   - **Improved Safety:** The `readObject` method no longer relies on a method that could be overridden, reducing the likelihood of unexpected behavior during deserialization.
   - **Consistency:** By capturing the `ClassLoader` at initialization, the deserialization process becomes more predictable and less dependent on runtime thread states.
   - **Compliance with Best Practices:** The changes align the code with best practices for deserialization, particularly avoiding non-final or overridable methods during critical operations.
   
   #### **Conclusion**
   This fix ensures the `EventListenerSupport` class is more robust, secure, and reliable during deserialization while maintaining its original functionality. These changes also resolve the SpotBugs warning without introducing breaking changes to the codebase. 


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: issues-unsubscribe@commons.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org

Re: [PR] Fix MC_OVERRIDABLE_METHOD_CALL_IN_READ_OBJECT in EventListenerSupport class [commons-lang]

Posted by "garydgregory (via GitHub)" <gi...@apache.org>.

garydgregory commented on PR #1319:
URL: https://github.com/apache/commons-lang/pull/1319#issuecomment-2505123793

   Hello @GracieleRodrigues-dev 
   
   One cannot "ignore" a commit in a PR, it's all or nothing. You need to update the PR.


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: issues-unsubscribe@commons.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org

Re: [PR] Fix MC_OVERRIDABLE_METHOD_CALL_IN_READ_OBJECT in EventListenerSupport class [commons-lang]

Posted by "GracieleRodrigues-dev (via GitHub)" <gi...@apache.org>.

GracieleRodrigues-dev closed pull request #1319: Fix MC_OVERRIDABLE_METHOD_CALL_IN_READ_OBJECT in EventListenerSupport class
URL: https://github.com/apache/commons-lang/pull/1319


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: issues-unsubscribe@commons.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org

Re: [PR] Fix MC_OVERRIDABLE_METHOD_CALL_IN_READ_OBJECT in EventListenerSupport class [commons-lang]

Posted by "GracieleRodrigues-dev (via GitHub)" <gi...@apache.org>.

GracieleRodrigues-dev commented on PR #1319:
URL: https://github.com/apache/commons-lang/pull/1319#issuecomment-2505023851

   Please ignore the commit - [Fix string comparisons and handle null values safely](https://github.com/apache/commons-lang/pull/1319/commits/48adab2a6b6cfb838f06795e00cff051ab0fa031)


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: issues-unsubscribe@commons.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org