apache / apache/fory

[Java] allow 'unsafe' Fory usage where class allow/disallow list are not enforced

Open
#2,383 2 comments 0 reactions 0 assignees View on GitHub
enhancement
Dominant language
Java
Stars
4.5k
Forks
443
Avg merge
5h 59m
Merged PRs (30d)
77

Description

### Feature Request

We definitely want Fory to be relatively secure by default. Of course, deserializing is always a minefield in Java and the disallow list in Fory may not have everything in it.
Users sending Fory formatted class instances over the wire should use secure networks. If you have a secure network, users might want to enable unsafe mode and accept the risks. If malicious users can't send messages to your application then this might be acceptable.
When deserializing, checking the classes against the disallow list (for instance) does take a certain amount of time.
If this feature was added, we could add warnings in the docs to discourage its users unless the users understand what they are doing.

### Is your feature request related to a problem? Please describe

_No response_

### Describe the solution you'd like

_No response_

### Describe alternatives you've considered

_No response_

### Additional context

_No response_

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.