AVRO-4189: [java] Simplify the setting of the serializable classes by gszadovszky · Pull Request #3525 · apache/avro

gszadovszky · 2025-10-20T18:06:21Z

What is the purpose of the change

(For example: This pull request improves file read performance by buffering data, fixing AVRO-XXXX.)

Verifying this change

(Please pick one of the following options)

This change is a trivial rework / code cleanup without any test coverage.

(or)

This change is already covered by existing tests, such as (please describe tests).

(or)

This change added tests and can be verified as follows:

(example:)

Extended interop tests to verify consistent valid schema names between SDKs
Added test that validates that Java throws an AvroRuntimeException on invalid binary data
Manually verified the change by building the website and checking the new redirect

Documentation

Does this pull request introduce a new feature? (yes / no)
If yes, how is the feature documented? (not applicable / docs / JavaDocs / not documented)

Copilot

Pull Request Overview

This PR refactors the class security validation mechanism in Apache Avro by introducing a new ClassSecurityValidator utility that centralizes and simplifies how trusted classes and packages are configured. The change allows using package-level whitelisting instead of requiring explicit enumeration of every class, reducing configuration verbosity.

Key Changes:

Introduced ClassSecurityValidator class with a builder pattern and predicate-based validation
Added support for org.apache.avro.SERIALIZABLE_PACKAGES system property to whitelist entire packages
Migrated validation logic from SpecificDatumReader to the centralized ClassSecurityValidator

Reviewed Changes

Copilot reviewed 9 out of 9 changed files in this pull request and generated 3 comments.

Show a summary per file

File	Description
lang/java/avro/src/main/java/org/apache/avro/util/ClassSecurityValidator.java	New utility class implementing the centralized class security validation with builder pattern and system property support
lang/java/avro/src/main/java/org/apache/avro/util/ClassUtils.java	Updated to use the new `ClassSecurityValidator` and load classes without initialization for security validation
lang/java/avro/src/main/java/org/apache/avro/specific/SpecificDatumReader.java	Refactored to delegate security validation to `ClassSecurityValidator` and deprecated old validation methods
lang/java/avro/src/test/java/org/apache/avro/util/TestClassSecurityValidator.java	New test class covering various validation scenarios including builder, predicates, and composite validators
lang/java/avro/src/test/java/org/apache/avro/specific/TestSpecificRecordWithUnion.java	Added test to verify `SecurityException` is thrown for untrusted classes
lang/java/avro/src/test/java/org/apache/avro/reflect/TestReflectDatumReader.java	Added test to verify `SecurityException` is thrown for untrusted classes during reflection
lang/java/avro/pom.xml	Updated system properties to use package whitelisting instead of individual class enumeration
lang/java/avro/src/it/pom.xml	Updated system properties to use package whitelisting instead of individual class enumeration
lang/java/ipc/pom.xml	Updated system properties to use package whitelisting instead of individual class enumeration

_{Tip: Customize your code reviews with copilot-instructions.md. Create the file or learn how to get started.}

lang/java/avro/src/main/java/org/apache/avro/specific/SpecificDatumReader.java

lang/java/avro/src/main/java/org/apache/avro/util/ClassUtils.java

lang/java/avro/src/main/java/org/apache/avro/util/ClassSecurityValidator.java

RyanSkraba

This LGTM -- I'm pretty confident in this implementation (and it has improved readability in what it's doing). We should definitely cherry-pick this to 1.11.x as well.

RyanSkraba · 2025-10-22T15:38:33Z

lang/java/avro/src/main/java/org/apache/avro/util/ClassUtils.java

    }
    if (c == null) {
-      throw new ClassNotFoundException("Failed to load class" + className);
+      throw new ClassNotFoundException("Failed to load class " + className);


Nice catch!

…3525) * AVRO-4189: [java] Simplify the setting of the serializable classes * Fix missing license header * Fix test failures + copilot findings * Fix system property settings in pomx

RyanSkraba · 2025-10-22T15:51:27Z

Cherry-picked to branch-1.12.

…3525) * AVRO-4189: [java] Simplify the setting of the serializable classes * Fix missing license header * Fix test failures + copilot findings * Fix system property settings in pomx (cherry picked from commit e0217ae)

gszadovszky · 2025-10-27T15:21:40Z

Cherry-picked to branch-1.11

gszadovszky · 2025-10-27T15:25:39Z

@martin-g, thanks for pushing/cherry-picking my change.

I've cherry-picked to 1.11 as well. Then, I've realized, there is a branch called ci-for-branch-1.11. Not sure about its purpose. Shall I also cherry-pick it to there?

Also, may we have new releases with this change from 1.11 and 1.12?

martin-g · 2025-10-27T16:01:36Z

Credits go to @RyanSkraba !

@opwvhk Which branch should be used for 1.11.x ?

opwvhk · 2025-10-27T16:25:30Z

I don't know about the ci- branch. The 1.11.x releases all came from branch-1.11.

gszadovszky · 2025-10-27T16:28:54Z

Sorry, @martin-g, not sure why I've pinged you about this...

Meanwhile, I've made a mistake during the backport. Could you check #3538, please?

AVRO-4189: [java] Simplify the setting of the serializable classes

69c95af

github-actions bot added Java Pull Requests for Java binding build labels Oct 20, 2025

gszadovszky requested review from martin-g and nandorKollar October 20, 2025 18:06

Fix missing license header

e82341d

martin-g requested a review from Copilot October 21, 2025 08:55

Copilot AI reviewed Oct 21, 2025

View reviewed changes

gszadovszky added 2 commits October 21, 2025 12:18

Fix test failures + copilot findings

3338b0a

Fix system property settings in pomx

7bdd7cd

RyanSkraba approved these changes Oct 22, 2025

View reviewed changes

RyanSkraba merged commit e0217ae into apache:main Oct 22, 2025
9 checks passed

This was referenced Oct 23, 2025

[java] Refactor java class deserialization checks #3459

Open

AVRO-3985: [JAVA] adding default serializable pacakge to trusted package list #3333

Closed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

AVRO-4189: [java] Simplify the setting of the serializable classes#3525

AVRO-4189: [java] Simplify the setting of the serializable classes#3525
RyanSkraba merged 4 commits intoapache:mainfrom
gszadovszky:AVRO-4189

gszadovszky commented Oct 20, 2025

Uh oh!

Copilot AI left a comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

RyanSkraba left a comment

Uh oh!

RyanSkraba Oct 22, 2025

Uh oh!

Uh oh!

RyanSkraba commented Oct 22, 2025 •

edited

Loading

Uh oh!

gszadovszky commented Oct 27, 2025

Uh oh!

gszadovszky commented Oct 27, 2025

Uh oh!

martin-g commented Oct 27, 2025

Uh oh!

opwvhk commented Oct 27, 2025

Uh oh!

gszadovszky commented Oct 27, 2025 •

edited

Loading

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

Comments

Conversation

gszadovszky commented Oct 20, 2025

What is the purpose of the change

Verifying this change

Documentation

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull Request Overview

Reviewed Changes

Uh oh!

Uh oh!

Uh oh!

Uh oh!

RyanSkraba left a comment

Choose a reason for hiding this comment

Uh oh!

RyanSkraba Oct 22, 2025

Choose a reason for hiding this comment

Uh oh!

Uh oh!

RyanSkraba commented Oct 22, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

gszadovszky commented Oct 27, 2025

Uh oh!

gszadovszky commented Oct 27, 2025

Uh oh!

martin-g commented Oct 27, 2025

Uh oh!

opwvhk commented Oct 27, 2025

Uh oh!

gszadovszky commented Oct 27, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

Comments

RyanSkraba commented Oct 22, 2025 •

edited

Loading

gszadovszky commented Oct 27, 2025 •

edited

Loading