You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@fory.apache.org by "chaokunyang (via GitHub)" <gi...@apache.org> on 2026/08/21 03:42:19 UTC
[PR] fix(security): harden untrusted deserialization paths [fory]
chaokunyang opened a new pull request, #3955:
URL: https://github.com/apache/fory/pull/3955
## What does this PR do?
This PR hardens untrusted deserialization across Fory runtimes and aligns shared metadata cache semantics with the wire protocol.
Key changes:
- make remote `TypeDef` and `TypeMeta` checked caches use the protocol top 52-bit hash as schema identity while keeping current-frame low bits only for bounded body skipping;
- make large `MetaString` cache hits use the wire hash alone as identity, independent of the current body length;
- route cached and shared metadata through the concrete owner selected on the validated miss, rejecting incompatible declared owners before cache, version, or root-table publication;
- fix Python/Cython published-list mutation safety and strict/default reduce callable authorization;
- bound Java metadata decompression and stream growth, tighten the disallowed-class list, and guard dynamic/generated field assignment;
- fix Rust UTF-16 bounds handling and concrete metadata routing for static/grouped carriers;
- enforce Swift nested decoder depth consistently across generated and compatible owners;
- document trusted-input boundaries and the cache-hit validation model.
The wire format is unchanged. Cache hits do not reparse or revalidate metadata bodies; only cold misses perform body/hash/policy/limit validation and publish non-local checked metadata.
## Validation
- Full Java-driven xlang matrix after the final fix:
- C++: 95 tests, 0 failures/errors, 2 skipped
- C#: 105 tests, 0 failures/errors
- Rust: 99 tests, 0 failures/errors
- Go: 99 tests, 0 failures/errors, 2 skipped
- Python pure and Cython: 99 tests each, 0 failures/errors, 20 skipped
- Swift: 97 tests, 0 failures/errors
- Python: Cython 793 passed; pure Python 788 passed.
- Rust: workspace tests, strict Clippy, rustfmt, and diff check passed.
- Swift: 273 tests plus swift-format and SwiftLint passed.
- C#: 373 tests, Release build, generator tests, and format verification passed.
- JavaScript: TypeMeta 104/104 and core 15/15 passed; build, ESLint, and Prettier passed for touched files.
- Go, Dart, and C++ full affected-runtime tests/builds and formatting passed.
- Java/Kotlin focused suites, real KSP-generated runtime test, extensions, Spotless, Checkstyle, and docs Prettier passed.
- `git diff --check` passed.
The local JDK 25 full Java run has one unrelated existing exception-shape mismatch in `ForyTest.testJDKSerializableCheck`: JDK 25 returns a direct `InsecureException` with no cause while the helper expects a nested cause. All affected Java tests and the complete xlang matrix pass.
## Performance
Compared sequentially against a fresh `apache/main` worktree at `8728bd82535637aebc100cf47348fb3957347110`:
- Java sample-list deserialize: paired median `+0.610%` throughput; MetaShare was faster.
- Python/Cython sample-list deserialize: `-0.591%` and `-0.680%` latency.
- Swift sample-list deserialize, 30-second pair: `+0.241%` latency.
- Rust sample-list deserialize: `-0.468%` and `-3.060%` latency.
- C++ sample-list deserialize, six balanced pairs: `-0.136%` median and `+0.059%` mean latency.
All retained affected hot paths are within the 1% regression gate.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@fory.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: commits-unsubscribe@fory.apache.org
For additional commands, e-mail: commits-help@fory.apache.org
Re: [PR] feat: harden deserialization paths [fory]
Posted by "chaokunyang (via GitHub)" <gi...@apache.org>.
chaokunyang merged PR #3955:
URL: https://github.com/apache/fory/pull/3955
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@fory.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: commits-unsubscribe@fory.apache.org
For additional commands, e-mail: commits-help@fory.apache.org