[FLINK-6421] Unchecked reflection calls in PojoSerializer

• Type: Bug
• Status: Resolved
• Priority: Minor
• Resolution: Not A Problem
• Component/s: API / Type Serialization System
• Assignee: Unassigned
• Reporter: Ted Yu
• Created: 29/Apr/17 19:32
• Updated: 23/May/17 03:36
• Resolved: 23/May/17 03:36

Description

Here is one example:

      String subclassName = source.readUTF();
      try {
        actualSubclass = Class.forName(subclassName, true, cl);

subclassName may carry tainted value, allowing an attacker to bypass security checks, obtain unauthorized data, or execute arbitrary code