SEZ9 commented on PR #11559: URL: https://github.com/apache/seatunnel/pull/11559#issuecomment-6621827167
Thanks for the detailed follow-up on head `949ac4f70763c80d8a4d83fb0384f4cd9fd08a0c`. From my side the only item still open is the HIGH security finding from my earlier review: the unsafe Java deserialization pattern in `seatunnel-connectors-v2/connector-kafka/src/main/java/org/apache/seatunnel/connectors/seatunnel/kafka/source/KafkaSourceReader.java`. The write-ups above cover the other items, but I don't see anything in the descriptions of `bb23b9f2` / `a4ab739b` / `949ac4f7` that touches `KafkaSourceReader.java`, so I can't yet mark it resolved. Before I re-review, could you: 1. Point me to the commit (or confirm it is still pending) that removes the raw Java deserialization path in `KafkaSourceReader.java`. Preferred direction: don't deserialize arbitrary Java objects from record payloads at all; go through the configured schema/format deserializer. If native Java deserialization is genuinely required, it should be restricted with a strict class allow-list that only admits the exact types the reader expects. 2. Add a unit test that feeds a record carrying a serialized class outside the allow-list and asserts it is rejected rather than instantiated. 3. Add a short note in the PR description on why the chosen approach is safe. Once that lands I'll go through the deserialization change together with the rest of this head. <!-- streview-comment:2266 --> -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
