HADOOP-19930. ObjectWritable to validate class on load - #8640
Merged
steveloughran merged 4 commits intoSep 8, 2026
Merged
steveloughran merged 4 commits into
steveloughran merged 4 commits into
Conversation
6 tasks
|
💔 -1 overall
This message was automatically generated. |
Contributor
Author
|
conflict in TFile to resolve |
New reflection validation in ReflectionUtils -Pulls up class type checking to before actual class load; fails fast -Add check of array length. -Limit recursive depth to 100. +Sequence file logic. Conf loading does force classloading, so move sequence file logic out of it. This does remove it from the conf file weak hash map of classes, but the jvm does its own class map here. The real feature of the conf map is the caching of cache misses, which would actually surface as errors on reading files, so you aren't saving anything performance-wise. Contains content generated by Claude.ai Contributed by Steve Loughran.
steveloughran
force-pushed
the
pr/HADOOP-19864-writable-load-validation
branch
from
August 24, 2026 18:14
df7fca6 to
0cbe6cf
Compare
|
💔 -1 overall
This message was automatically generated. |
ajfabbri
approved these changes
Aug 27, 2026
ajfabbri
left a comment
Contributor
There was a problem hiding this comment.
LGTM pending removal of unrelated change. Other comments are just nits.
| update: | ||
| name: "Update Build Status" | ||
| runs-on: ubuntu-slim | ||
| if: github.repository == 'apache/hadoop' |
| in.readFully(bytes, 0, length); | ||
| return Text.decode(bytes); | ||
| } | ||
|
|
Contributor
There was a problem hiding this comment.
nit: superfluous whitespace change
| public void testDeepNestingRejected() throws Exception { | ||
| DataOutputBuffer out = new DataOutputBuffer(); | ||
| String arrayClass = Object[].class.getName(); | ||
| for (int i = 0; i < 110; i++) { // each level: an Object[] of length 1 |
Contributor
There was a problem hiding this comment.
Not a blocking comment, but a constant for 100 depth limit and using it here (X + 10) would be clearer to future generations.
Contributor
Author
There was a problem hiding this comment.
there is a constant; made package private and referenced it
|
💔 -1 overall
This message was automatically generated. |
Contributor
Author
|
I'm doing the merge with the approval. The build/test is failing in the debian java 25 setup now I've merged in trunk, which I'm going to assert is unrelated. Bad, needs fixing, but unrelated. |
6 tasks
steveloughran
added a commit
that referenced
this pull request
Sep 9, 2026
New reflection validation in ReflectionUtils -Pulls up class type checking to before actual class load; fails fast -Add check of array length. -Limit recursive depth to 100. This is used in SequenceFile, InputSplits and elsewhere that Writable subclasses instantiate classes. Contributed by Steve Loughran Assisted-by: Claude.ai "This is Ripley, last survivor of the Nostromo, signing off." 9589683f-369f-4a30-8c93-e9f5d04ceb5a
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Validate class instantiation through ObjectWritable and elsewhere to make sure
the class is of the requested type before the class is instantiated
New reflection validation in ReflectionUtils
-Pulls up class type checking to before actual class load; fails fast -Add check of array length.
-Limit recursive depth to 100.
This is #8569 on a new branch to get yetus to pick it up
Contains content generated by Claude.ai
For code changes:
LICENSE,LICENSE-binary,NOTICE-binaryfiles?AI Tooling
If an AI tool was used:
where is the name of the AI tool used.
https://www.apache.org/legal/generative-tooling.html