[
https://issues.apache.org/jira/browse/RATIS-2659?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel
]
Tsz-wo Sze updated RATIS-2659:
------------------------------
Summary: IOUtils.readObject(..) should apply an allow-list filter (was:
IOUtils.readObject(..) should filter classes)
> IOUtils.readObject(..) should apply an allow-list filter
> --------------------------------------------------------
>
> Key: RATIS-2659
> URL: https://issues.apache.org/jira/browse/RATIS-2659
> Project: Ratis
> Issue Type: Improvement
> Components: util
> Reporter: Tsz-wo Sze
> Assignee: Tsz-wo Sze
> Priority: Major
> Attachments: image-2026-08-15-14-15-40-413.png
>
> Time Spent: 10m
> Remaining Estimate: 0h
>
> {quote}Java : how to securely read an object from network using
> ObjectInputStream to avoid remote code execution?
> {quote}
> - According to Google AI responding to the question above, we should use
> ObjectInputFilter in IOUtils.readObject(..). Unfortunately, ObjectInputFilter
> is added to Java 9 but not in Java 8.
> - Therefore, we will create our own filter by extending ObjectInputStream and
> overriding the resolveClass(..) method. (Suggested by Claude)
> - For compatibility, we have to support the current format for awhile before
> changing it to a safer format such as JSON.
> Note that this is not a security vulnerability in Ratis since Ratis is a
> library. Applications using Ratis should enforce security (such as [using
> TLS|https://github.com/apache/ratis/blob/master/ratis-docs/src/site/markdown/security.md])
> if it is needed.
> (Thanks Qing Xu for reporting the problem of using ObjectInputStream!)
> !image-2026-08-15-14-15-40-413.png|width=600!
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
