From 740be7761a75b002d08d0050727f8efe6f68ceaa Mon Sep 17 00:00:00 2001 From: L1nq0 Date: Fri, 4 Sep 2026 11:40:58 +0800 Subject: [PATCH] Harden the java serialization fallback bridge with a JEP-290 serial filter Add topology.fall.back.on.java.serialization.filter, a JEP-290 filter pattern for the java serialization fallback bridge. DefaultKryoFactory parses the pattern once at kryo construction, so an invalid pattern fails worker setup with the config key in the error, and SerializableSerializer installs it via setObjectInputFilter whenever it deserializes. The filter is topology-scoped and also covers programmatic construction such as local mode, which a JVM-wide jdk.serialFilter in worker.childopts does not reach. conf/defaults.yaml sets a default pattern: a deny-list of well-known gadget namespaces (commons-collections 3/4 functors and comparators, beanutils, xalan external and JDK-internal, rowset, c3p0, groovy closures) plus maxbytes=10485760. An empty or unset value leaves the bridge unfiltered, as before. The pattern uses JEP-290 wildcards: pkg.* covers direct package members and pkg.** also covers subpackages; tests exercise both depths against loadable classes in denied packages, end to end through KryoValuesSerializer and KryoValuesDeserializer. --- conf/defaults.yaml | 1 + docs/SECURITY.md | 2 + docs/Serialization.md | 2 + .../src/jvm/org/apache/storm/Config.java | 14 ++ .../serialization/DefaultKryoFactory.java | 26 ++- .../serialization/SerializableSerializer.java | 20 ++ .../mchange/v2/c3p0/impl/SimulatedGadget.java | 23 +++ .../comparators/SimulatedGadget.java | 23 +++ .../collections/functors/SimulatedGadget.java | 24 +++ .../SerializableSerializerFilterTest.java | 187 ++++++++++++++++++ 10 files changed, 321 insertions(+), 1 deletion(-) create mode 100644 storm-client/test/jvm/com/mchange/v2/c3p0/impl/SimulatedGadget.java create mode 100644 storm-client/test/jvm/org/apache/commons/collections/comparators/SimulatedGadget.java create mode 100644 storm-client/test/jvm/org/apache/commons/collections/functors/SimulatedGadget.java create mode 100644 storm-client/test/jvm/org/apache/storm/serialization/SerializableSerializerFilterTest.java diff --git a/conf/defaults.yaml b/conf/defaults.yaml index 6fd7a04b9d4..d8e0422849e 100644 --- a/conf/defaults.yaml +++ b/conf/defaults.yaml @@ -309,6 +309,7 @@ topology.upstream.feedback.freq.secs: 10 topology.upstream.feedback.enable: false topology.builtin.metrics.bucket.size.secs: 60 topology.fall.back.on.java.serialization: false +topology.fall.back.on.java.serialization.filter: "!org.apache.commons.collections.functors.*;!org.apache.commons.collections.comparators.*;!org.apache.commons.collections4.functors.*;!org.apache.commons.collections4.comparators.*;!org.apache.commons.beanutils.*;!org.apache.xalan.xsltc.trax.*;!com.sun.org.apache.xalan.internal.**;!com.sun.rowset.*;!com.sun.org.apache.rowset.internal.*;!com.mchange.v2.c3p0.**;!org.codehaus.groovy.runtime.ConvertedClosure;!org.codehaus.groovy.runtime.MethodClosure;maxbytes=10485760" topology.worker.childopts: null topology.worker.logwriter.childopts: "-Xmx64m" topology.tick.tuple.freq.secs: null diff --git a/docs/SECURITY.md b/docs/SECURITY.md index 03c71993c81..028e870c360 100644 --- a/docs/SECURITY.md +++ b/docs/SECURITY.md @@ -663,6 +663,8 @@ Storm uses Kryo for serializing tuple data between spouts and bolts. By default, **Do not set `topology.fall.back.on.java.serialization` to `true` in production.** While topology submitters already run arbitrary code via their spouts and bolts, enabling the Java serialization fallback broadens the attack surface and may allow malicious data from external sources (e.g. message queues) to trigger unintended code execution during deserialization. +As defense in depth, the fallback bridge is constrained by `topology.fall.back.on.java.serialization.filter`, a [JEP-290](https://openjdk.org/jeps/290) serial-filter pattern applied whenever the bridge deserializes. `conf/defaults.yaml` sets a default pattern: a deny-list of well-known gadget namespaces plus `maxbytes=10485760`. An empty or unset value leaves the bridge unfiltered, as before. This reduces the impact of a misconfigured cluster. + For tuple encryption, use TLS-based transport encryption (`storm.messaging.netty.tls.enable`) instead of the deprecated `BlowfishTupleSerializer`, which uses a 64-bit block cipher vulnerable to birthday attacks. ### Log Cleanup diff --git a/docs/Serialization.md b/docs/Serialization.md index 8f87ba6b043..81f9def5548 100644 --- a/docs/Serialization.md +++ b/docs/Serialization.md @@ -61,6 +61,8 @@ Beware that Java serialization is extremely expensive, both in terms of CPU cost You can turn on/off the behavior to fall back on Java serialization by setting the `Config.TOPOLOGY_FALL_BACK_ON_JAVA_SERIALIZATION` config to true/false. The default value is false for security reasons. +When the fallback is enabled, the bridge can be constrained with `Config.TOPOLOGY_FALL_BACK_ON_JAVA_SERIALIZATION_FILTER`, a [JEP-290](https://openjdk.org/jeps/290) serial-filter pattern (e.g. `!org.apache.commons.collections4.functors.*;maxbytes=10485760`) applied to every `ObjectInputStream` the bridge uses for deserialization. The pattern is parsed when the serialization stack is created, so an invalid pattern fails worker setup with the config key in the error. `conf/defaults.yaml` carries a default deny-list of well-known gadget namespaces with a `maxbytes=10485760` limit; an empty or unset value leaves the bridge unfiltered, as before. Unlike a JVM-wide `-Djdk.serialFilter`, this filter is topology-scoped and also applies when the deserializer is constructed programmatically, e.g. in local mode. + ### Tuple compression For inter-worker (remote) traffic, Storm can optionally compress serialized tuples with [Zstandard](https://facebook.github.io/zstd/) before they are sent over the network. This is intended for one specific scenario: components that emit **large** payloads to a remote worker, where the bytes saved on the wire outweigh the CPU cost of compression. A good example is a spout that emits entire lines of text to a downstream bolt running on a different worker. diff --git a/storm-client/src/jvm/org/apache/storm/Config.java b/storm-client/src/jvm/org/apache/storm/Config.java index 4e3dbe061bf..304210bcda1 100644 --- a/storm-client/src/jvm/org/apache/storm/Config.java +++ b/storm-client/src/jvm/org/apache/storm/Config.java @@ -660,6 +660,20 @@ public class Config extends HashMap { */ @IsBoolean public static final String TOPOLOGY_FALL_BACK_ON_JAVA_SERIALIZATION = "topology.fall.back.on.java.serialization"; + /** + * Optional JEP-290 serial-filter pattern applied to the + * Java-serialization fallback bridge that {@link #TOPOLOGY_FALL_BACK_ON_JAVA_SERIALIZATION} enables for + * unregistered classes. When set to a non-empty pattern, it is parsed once at kryo construction and installed + * on every {@code ObjectInputStream} used to deserialize fallback values, so stream classes rejected by the + * filter are neither instantiated nor have their {@code readObject} logic invoked. {@code conf/defaults.yaml} + * sets a default gadget deny-list with a {@code maxbytes=10485760} limit; an empty or unset value leaves the + * bridge unfiltered, as before. An invalid pattern fails worker startup with a clear error. Note: Unlike a + * JVM-wide {@code jdk.serialFilter}, this is topology-scoped and also applies when the deserializer is built + * programmatically, e.g. local mode. Example deny-list: {@code !org.apache.commons.collections4.functors.*}. + */ + @IsString + public static final String TOPOLOGY_FALL_BACK_ON_JAVA_SERIALIZATION_FILTER = + "topology.fall.back.on.java.serialization.filter"; /** * Topology-specific options for the worker child process. This is used in addition to WORKER_CHILDOPTS. */ diff --git a/storm-client/src/jvm/org/apache/storm/serialization/DefaultKryoFactory.java b/storm-client/src/jvm/org/apache/storm/serialization/DefaultKryoFactory.java index ef00ea47f75..aba08fe2001 100644 --- a/storm-client/src/jvm/org/apache/storm/serialization/DefaultKryoFactory.java +++ b/storm-client/src/jvm/org/apache/storm/serialization/DefaultKryoFactory.java @@ -15,6 +15,7 @@ import com.esotericsoftware.kryo.Kryo; import com.esotericsoftware.kryo.Serializer; import com.esotericsoftware.kryo.util.Util; +import java.io.ObjectInputFilter; import java.util.Map; import org.apache.storm.Config; import org.slf4j.Logger; @@ -29,9 +30,27 @@ public Kryo getKryo(Map conf) { KryoSerializableDefault k = new KryoSerializableDefault(); k.setRegistrationRequired(!((Boolean) conf.get(Config.TOPOLOGY_FALL_BACK_ON_JAVA_SERIALIZATION))); k.setReferences(false); + k.setJavaSerializationFilter(getJavaSerializationFilter(conf)); return k; } + /** + * Parses the pattern once at kryo construction so an invalid pattern fails worker setup with a clear error + * instead of failing per-tuple on the read path. Returns null when the key is unset or empty (no filter). + */ + private static ObjectInputFilter getJavaSerializationFilter(Map conf) { + String filterSpec = (String) conf.get(Config.TOPOLOGY_FALL_BACK_ON_JAVA_SERIALIZATION_FILTER); + if (filterSpec == null || filterSpec.isEmpty()) { + return null; + } + try { + return ObjectInputFilter.Config.createFilter(filterSpec); + } catch (IllegalArgumentException e) { + throw new RuntimeException("Invalid " + Config.TOPOLOGY_FALL_BACK_ON_JAVA_SERIALIZATION_FILTER + + " pattern: \"" + filterSpec + "\"", e); + } + } + @Override public void preRegister(Kryo k, Map conf) { } @@ -47,6 +66,11 @@ public void postDecorate(Kryo k, Map conf) { public static class KryoSerializableDefault extends Kryo { boolean override = false; + private ObjectInputFilter javaSerializationFilter; + + public void setJavaSerializationFilter(ObjectInputFilter filter) { + this.javaSerializationFilter = filter; + } public void overrideDefault(boolean value) { override = value; @@ -61,7 +85,7 @@ public Serializer getDefaultSerializer(Class type) { Util.className(type), Util.className(type) ); - return new SerializableSerializer(); + return new SerializableSerializer(javaSerializationFilter); } else { return super.getDefaultSerializer(type); } diff --git a/storm-client/src/jvm/org/apache/storm/serialization/SerializableSerializer.java b/storm-client/src/jvm/org/apache/storm/serialization/SerializableSerializer.java index f17689cb6de..b905419a041 100644 --- a/storm-client/src/jvm/org/apache/storm/serialization/SerializableSerializer.java +++ b/storm-client/src/jvm/org/apache/storm/serialization/SerializableSerializer.java @@ -19,12 +19,29 @@ import java.io.ByteArrayInputStream; import java.io.ByteArrayOutputStream; import java.io.IOException; +import java.io.ObjectInputFilter; import java.io.ObjectInputStream; import java.io.ObjectOutputStream; public class SerializableSerializer extends Serializer { + /** + * Optional JEP-290 filter applied to each ObjectInputStream used for deserialization (null means unfiltered, + * as before). The filter itself is created once from + * {@link org.apache.storm.Config#TOPOLOGY_FALL_BACK_ON_JAVA_SERIALIZATION_FILTER} by {@link DefaultKryoFactory}; + * instances returned by {@link ObjectInputFilter.Config#createFilter} are immutable and safe to share across streams. + */ + private final ObjectInputFilter serialFilter; + + public SerializableSerializer() { + this(null); + } + + public SerializableSerializer(ObjectInputFilter serialFilter) { + this.serialFilter = serialFilter; + } + @Override public void write(Kryo kryo, Output output, Object object) { ByteArrayOutputStream bos = new ByteArrayOutputStream(); @@ -48,6 +65,9 @@ public Object read(Kryo kryo, Input input, Class c) { ByteArrayInputStream bis = new ByteArrayInputStream(ser); try { ObjectInputStream ois = new ObjectInputStream(bis); + if (serialFilter != null) { + ois.setObjectInputFilter(serialFilter); + } return ois.readObject(); } catch (Exception e) { throw new RuntimeException(e); diff --git a/storm-client/test/jvm/com/mchange/v2/c3p0/impl/SimulatedGadget.java b/storm-client/test/jvm/com/mchange/v2/c3p0/impl/SimulatedGadget.java new file mode 100644 index 00000000000..2d0d161714c --- /dev/null +++ b/storm-client/test/jvm/com/mchange/v2/c3p0/impl/SimulatedGadget.java @@ -0,0 +1,23 @@ +/** + * Licensed to the Apache Software Foundation (ASF) under one or more contributor license agreements. See the NOTICE file distributed with + * this work for additional information regarding copyright ownership. The ASF licenses this file to you under the Apache License, Version + * 2.0 (the "License"); you may not use this file except in compliance with the License. You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the specific language governing permissions + * and limitations under the License. + */ + +package com.mchange.v2.c3p0.impl; + +import java.io.Serializable; + +/** + * Placeholder under com.mchange.v2.c3p0.impl; sits in a subpackage so the tests cover the difference between pkg.* and pkg.** entries. + */ +public class SimulatedGadget implements Serializable { + + private static final long serialVersionUID = 1L; +} diff --git a/storm-client/test/jvm/org/apache/commons/collections/comparators/SimulatedGadget.java b/storm-client/test/jvm/org/apache/commons/collections/comparators/SimulatedGadget.java new file mode 100644 index 00000000000..82648a0da18 --- /dev/null +++ b/storm-client/test/jvm/org/apache/commons/collections/comparators/SimulatedGadget.java @@ -0,0 +1,23 @@ +/** + * Licensed to the Apache Software Foundation (ASF) under one or more contributor license agreements. See the NOTICE file distributed with + * this work for additional information regarding copyright ownership. The ASF licenses this file to you under the Apache License, Version + * 2.0 (the "License"); you may not use this file except in compliance with the License. You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the specific language governing permissions + * and limitations under the License. + */ + +package org.apache.commons.collections.comparators; + +import java.io.Serializable; + +/** + * Placeholder in the commons-collections comparators package; TransformingComparator gadgets live here, not in functors. + */ +public class SimulatedGadget implements Serializable { + + private static final long serialVersionUID = 1L; +} diff --git a/storm-client/test/jvm/org/apache/commons/collections/functors/SimulatedGadget.java b/storm-client/test/jvm/org/apache/commons/collections/functors/SimulatedGadget.java new file mode 100644 index 00000000000..f82278d9e6f --- /dev/null +++ b/storm-client/test/jvm/org/apache/commons/collections/functors/SimulatedGadget.java @@ -0,0 +1,24 @@ +/** + * Licensed to the Apache Software Foundation (ASF) under one or more contributor license agreements. See the NOTICE file distributed with + * this work for additional information regarding copyright ownership. The ASF licenses this file to you under the Apache License, Version + * 2.0 (the "License"); you may not use this file except in compliance with the License. You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the specific language governing permissions + * and limitations under the License. + */ + +package org.apache.commons.collections.functors; + +import java.io.Serializable; + +/** + * Placeholder class in the commons-collections functors package so the filter tests deny a class that actually loads (the gadget + * here is InvokerTransformer). + */ +public class SimulatedGadget implements Serializable { + + private static final long serialVersionUID = 1L; +} diff --git a/storm-client/test/jvm/org/apache/storm/serialization/SerializableSerializerFilterTest.java b/storm-client/test/jvm/org/apache/storm/serialization/SerializableSerializerFilterTest.java new file mode 100644 index 00000000000..5983cbe5d7f --- /dev/null +++ b/storm-client/test/jvm/org/apache/storm/serialization/SerializableSerializerFilterTest.java @@ -0,0 +1,187 @@ +/** + * Licensed to the Apache Software Foundation (ASF) under one or more contributor license agreements. See the NOTICE file distributed with + * this work for additional information regarding copyright ownership. The ASF licenses this file to you under the Apache License, Version + * 2.0 (the "License"); you may not use this file except in compliance with the License. You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the specific language governing permissions + * and limitations under the License. + */ + +package org.apache.storm.serialization; + +import java.io.InvalidClassException; +import java.io.ObjectInputFilter; +import java.util.ArrayDeque; +import java.util.Arrays; +import java.util.Collections; +import java.util.HashMap; +import java.util.Map; +import java.util.PriorityQueue; +import org.apache.commons.collections.functors.SimulatedGadget; +import org.apache.storm.Config; +import org.apache.storm.serialization.types.ListDelegateSerializer; +import org.apache.storm.utils.Utils; +import org.junit.jupiter.api.Test; + +import static org.junit.jupiter.api.Assertions.assertEquals; +import static org.junit.jupiter.api.Assertions.assertNotNull; +import static org.junit.jupiter.api.Assertions.assertThrows; +import static org.junit.jupiter.api.Assertions.assertIterableEquals; +import static org.junit.jupiter.api.Assertions.assertTrue; + +/** + * Tests for the JEP-290 serial filter ({@link Config#TOPOLOGY_FALL_BACK_ON_JAVA_SERIALIZATION_FILTER}) protecting the + * java-serialization fallback bridge. Every allow and deny case exercises an actual round-trip through the bridge, not the + * filter API in isolation. All round-trips go through KryoValuesSerializer and KryoValuesDeserializer end to end. + */ +public class SerializableSerializerFilterTest { + + /** The maxbytes limit set in conf/defaults.yaml. */ + private static final long DEFAULT_MAX_BYTES = 10485760L; + + /** + * Minimal conf that routes unregistered classes through the java-serialization fallback bridge. {@code filterSpec == null} + * means the filter key is absent from the conf entirely (the pre-existing behavior). + */ + private Map bridgeConf(String filterSpec) { + Map conf = new Config(); + conf.put(Config.TOPOLOGY_KRYO_FACTORY, DefaultKryoFactory.class.getName()); + conf.put(Config.TOPOLOGY_TUPLE_SERIALIZER, ListDelegateSerializer.class.getName()); + conf.put(Config.TOPOLOGY_SKIP_MISSING_KRYO_REGISTRATIONS, false); + conf.put(Config.TOPOLOGY_FALL_BACK_ON_JAVA_SERIALIZATION, true); + if (filterSpec != null) { + conf.put(Config.TOPOLOGY_FALL_BACK_ON_JAVA_SERIALIZATION_FILTER, filterSpec); + } + return conf; + } + + /** conf assembled exactly like a worker's would be: defaults.yaml + topology-level overrides. */ + private Map defaultsBridgeConf() { + Map conf = new Config(); + conf.putAll(Utils.readDefaultConfig()); + conf.put(Config.TOPOLOGY_FALL_BACK_ON_JAVA_SERIALIZATION, true); + return conf; + } + + private Object roundTrip(Map conf, Object value) { + KryoValuesSerializer serializer = new KryoValuesSerializer(conf); + KryoValuesDeserializer deserializer = new KryoValuesDeserializer(conf); + return deserializer.deserialize(serializer.serialize(Collections.singletonList(value))).get(0); + } + + /** Serializes {@code value} and asserts that reading it back fails with a JEP-290 rejection in the cause chain. */ + private void assertRejectedOnRead(Map conf, Object value) { + KryoValuesSerializer serializer = new KryoValuesSerializer(conf); + KryoValuesDeserializer deserializer = new KryoValuesDeserializer(conf); + // Writing is plain java serialization (filters apply to deserialization only), so this must succeed. + byte[] bytes = serializer.serialize(Collections.singletonList(value)); + RuntimeException ex = assertThrows(RuntimeException.class, () -> deserializer.deserialize(bytes)); + assertTrue(hasCause(ex, InvalidClassException.class), + "expected the JEP-290 filter rejection in the cause chain, got: " + ex); + } + + private static boolean hasCause(Throwable throwable, Class type) { + for (Throwable t = throwable; t != null; t = t.getCause()) { + if (type.isInstance(t)) { + return true; + } + } + return false; + } + + /** ArrayDeque and PriorityQueue do not override equals, so round-trips are compared by iteration content. */ + private static void assertSameContent(Iterable expected, Iterable actual) { + assertIterableEquals(expected, actual); + } + + @Test + public void testFilterRejectsDeniedClassOnDeserialization() { + Map conf = bridgeConf("!java.util.PriorityQueue"); + + PriorityQueue original = new PriorityQueue<>(Arrays.asList(3, 1, 2)); + assertRejectedOnRead(conf, original); + } + + @Test + public void testFilterAllowsNonDeniedClassesRoundTrip() { + Map conf = bridgeConf("!java.util.PriorityQueue"); + + // HashMap has a dedicated kryo serializer: ordinary payloads must keep round-tripping. + HashMap hashMap = new HashMap<>(Collections.singletonMap("one", 1)); + assertEquals(hashMap, roundTrip(conf, hashMap)); + + // ArrayDeque is unregistered and Serializable, so it travels through the java-serialization bridge itself. + ArrayDeque deque = new ArrayDeque<>(Arrays.asList("a", "b", "c")); + assertSameContent(deque, (ArrayDeque) roundTrip(conf, deque)); + } + + @Test + public void testUnsetFilterKeyKeepsUnfilteredBehavior() { + // No filter key in the conf at all: PriorityQueue must round-trip like it did before the filter existed. + PriorityQueue original = new PriorityQueue<>(Arrays.asList(5, 4, 6)); + assertSameContent(original, (PriorityQueue) roundTrip(bridgeConf(null), original)); + } + + @Test + public void testInvalidPatternFailsFastAtKryoConstruction() { + // The parser only rejects a few inputs: '!' (no pattern) and a non-numeric maxbytes; malformed class patterns + // are ignored, not rejected. + for (String invalid : Arrays.asList("!", "maxbytes=not-a-number")) { + Map conf = bridgeConf(invalid); + RuntimeException ex = assertThrows(RuntimeException.class, () -> new KryoValuesSerializer(conf)); + assertTrue(ex.getMessage().contains(Config.TOPOLOGY_FALL_BACK_ON_JAVA_SERIALIZATION_FILTER), + "error must name the offending config key: " + ex.getMessage()); + } + } + + @Test + public void testDefaultsYamlFilterParsesAndDeniesGadgetPackage() { + Map defaults = Utils.readDefaultConfig(); + Object filterSpec = defaults.get(Config.TOPOLOGY_FALL_BACK_ON_JAVA_SERIALIZATION_FILTER); + assertNotNull(filterSpec, "conf/defaults.yaml must define a default " + + Config.TOPOLOGY_FALL_BACK_ON_JAVA_SERIALIZATION_FILTER); + // The default pattern must parse (bad patterns throw IllegalArgumentException here). + ObjectInputFilter.Config.createFilter((String) filterSpec); + + // Through an actual round-trip: a class in a deny-listed package is rejected on read... + assertRejectedOnRead(defaultsBridgeConf(), new SimulatedGadget()); + // ...while ordinary JDK collections keep round-tripping under the same default. + PriorityQueue queue = new PriorityQueue<>(Arrays.asList(5, 4, 6)); + assertSameContent(queue, (PriorityQueue) roundTrip(defaultsBridgeConf(), queue)); + } + + @Test + public void testDefaultFilterRejectsCommonsCollections3Comparators() { + // CC3's TransformingComparator gadget chain lives in the comparators package (the functors pair alone is not enough). + assertRejectedOnRead(defaultsBridgeConf(), new org.apache.commons.collections.comparators.SimulatedGadget()); + } + + @Test + public void testDefaultFilterRejectsSubpackagesOfRecursiveWildcardEntries() { + // Wildcard depth matters: 'pkg.**' denies subpackages too; 'pkg.*' does not (c3p0.impl sits under the + // shipped '!com.mchange.v2.c3p0.**' entry). + assertRejectedOnRead(defaultsBridgeConf(), new com.mchange.v2.c3p0.impl.SimulatedGadget()); + } + + @Test + public void testDefaultFilterEnforcesMaxBytesLimit() { + Map conf = defaultsBridgeConf(); + // Every array read re-invokes the filter, so a stream built from many small arrays makes the cumulative + // streamBytes() limit bite mid-deserialization (one huge primitive payload would not re-invoke the filter). + ArrayDeque big = new ArrayDeque<>(); + for (int i = 0; i < 11000; i++) { + big.add(new byte[1024]); + } + KryoValuesSerializer serializer = new KryoValuesSerializer(conf); + KryoValuesDeserializer deserializer = new KryoValuesDeserializer(conf); + byte[] bytes = serializer.serialize(Collections.singletonList(big)); + assertTrue(bytes.length > DEFAULT_MAX_BYTES, "payload must exceed the default limit, was " + bytes.length); + + RuntimeException ex = assertThrows(RuntimeException.class, () -> deserializer.deserialize(bytes)); + assertTrue(hasCause(ex, InvalidClassException.class), + "expected the maxbytes rejection in the cause chain, got: " + ex); + } +}