remove java serialization from lucene/replicator [LUCENE-9095]
Open
legacy-jira-priority:Major
module:replicator
type:task
- Dominant language
- Java
- Stars
- 3.6k
- Forks
- 1.4k
- Avg merge
- 2d 11h
- Merged PRs (30d)
- 88
Description
This seems to be deserializing java objects from http streams.
In #10136 I marked the usages with SuppressForbidden, just to try to fend off additional serialization from being added to the codebase.
But we should really fix this one!
---
Migrated from [LUCENE-9095](https://issues.apache.org/jira/browse/LUCENE-9095) by Robert Muir (@rmuir)
Environment:
```
re
```
Linked issues:
- #10136
Contributor guide
Research direction
Start in the lucene/replicator code and trace where Java objects are deserialized from HTTP streams. Review linked issue #10136 for the existing SuppressForbidden markings, then define and verify a replacement approach that removes Java serialization from this path.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- java
- Domain
- backend, search
- Issue type
- Refactor
- Difficulty
- 5/5
- Estimated time
- Over a week
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 25/100