Skip to content

Conversation

@GoodBoyCoder
Copy link
Contributor

@GoodBoyCoder GoodBoyCoder commented Jul 4, 2025

  • I have registered the PR changes.

Ⅰ. Describe what this PR did

Fixed the class name whitelist check issue in fury deserialization

Ⅱ. Does this pull request fix one issue?

Ⅲ. Why don't you add test cases (unit test/integration test)?

Ⅳ. Describe how to verify it

Ⅴ. Special notes for reviews

@codecov
Copy link

codecov bot commented Jul 4, 2025

Codecov Report

All modified and coverable lines are covered by tests ✅

Project coverage is 60.37%. Comparing base (db73418) to head (72e3462).
Report is 1 commits behind head on 2.x.

Additional details and impacted files
@@             Coverage Diff              @@
##                2.x    #7498      +/-   ##
============================================
+ Coverage     60.34%   60.37%   +0.03%     
  Complexity      658      658              
============================================
  Files          1284     1284              
  Lines         48465    48465              
  Branches       5694     5694              
============================================
+ Hits          29247    29262      +15     
+ Misses        16600    16586      -14     
+ Partials       2618     2617       -1     
Files with missing lines Coverage Δ
...e/seata/serializer/fury/FurySerializerFactory.java 100.00% <100.00%> (ø)

... and 4 files with indirect coverage changes

Impacted file tree graph

🚀 New features to boost your workflow:
  • ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
  • 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

@slievrly slievrly changed the title Bugfix: fix the class name whitelist check issue in fury deserialization optimize: fix the class name whitelist check issue in fury deserialization Jul 5, 2025
@slievrly slievrly added this to the 2.5.0 milestone Jul 5, 2025
@slievrly slievrly changed the title optimize: fix the class name whitelist check issue in fury deserialization optimize: optimize fury deserialization Jul 5, 2025
Copy link
Member

@slievrly slievrly left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM

@slievrly slievrly merged commit d2a18ae into apache:2.x Jul 5, 2025
10 checks passed
SerializerSecurityRegistry.getAllowClassPattern().contains(className));
AllowListChecker checker = new AllowListChecker(AllowListChecker.CheckLevel.STRICT);
f.getClassResolver().setClassChecker(checker);
checker.allowClasses(SerializerSecurityRegistry.getAllowClassPattern());
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Would it be possible to add some tests for this change? The existing test coverage missed the fact there was a bug and no new tests were added in the PR.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants