[GitHub] [airflow] bolkedebruin commented on a diff in pull request #27887: Add allow list for imports during deserialization

[GitBox <gi...@apache.org>]

bolkedebruin commented on code in PR #27887:
URL: https://github.com/apache/airflow/pull/27887#discussion_r1032070380


##########
airflow/utils/json.py:
##########
@@ -189,7 +189,7 @@ def __init__(self, *args, **kwargs) -> None:
         if not kwargs.get("object_hook"):
             kwargs["object_hook"] = self.object_hook
 
-        patterns = conf.getjson("core", "allowed_deserialization_classes")
+        patterns = cast(list, conf.getjson("core", "allowed_deserialization_classes"))

Review Comment:
   Mmm yes, I'd prefer that check at configure time rather than here. The config file shouldn't validate if this is not a list. 



-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: commits-unsubscribe@airflow.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org