apache / apache/fory

[Java] Better ergonomics for AllowListChecker

Open
#3,050 6 comments 0 reactions 0 assignees View on GitHub
enhancement
Dominant language
Java
Stars
4.5k
Forks
443
Avg merge
5h 59m
Merged PRs (30d)
77

Description

### Feature Request

```
AllowListChecker checker = new AllowListChecker(AllowListChecker.CheckLevel.STRICT);
ThreadSafeFory fory = new ThreadLocalFory(classLoader -> {
Fory f = Fory.builder().requireClassRegistration(true).withClassLoader(classLoader).build();
f.getClassResolver().setClassChecker(checker);
checker.addListener(f.getClassResolver());
return f;
});
checker.allowClass("org.example.*");
```

I think it makes sense `setClassChecker` doing `checker.addListener(f.getClassResolver());` automatically unless I'm missing something.

Also after adding AllowListChecker I still get this error in log

`ForyBuilder:477 [Test worker] - Class registration isn't forced, unknown classes can be deserialized. If the environment isn't secure, please enable class registration by `ForyBuilder#requireClassRegistration(true)` or configure TypeChecker by `TypeResolver#setTypeChecker``

I think the security error should be suppressed with a `TypeChecker` registered since I'm not allowing any random class.

### Is your feature request related to a problem? Please describe

_No response_

### Describe the solution you'd like

I think either registration or TypeChecker should stop the unsafe serialization error.

### Describe alternatives you've considered

_No response_

### Additional context

_No response_

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.