[IGNITE-12962] Blacklist and whitelist of classes allowed to deserialize via HTTP-REST should be supported

• Type: Improvement
• Status: Resolved
• Priority: Major
• Resolution: Fixed
• Fix Version/s: 2.9
• Component/s: rest
• Ignite Flags: Docs Required, Release Notes Required
• Assignee: Pavel Pereslegin
• Reporter: Aleksey Plekhanov
• Created: 28/Apr/20 12:35
• Updated: 12/May/20 14:44
• Resolved: 12/May/20 14:44

Description

Since we have the ability to deserialize custom objects (implemented by IGNITE-12857) we should have the ability to limit the scope of classes allowed to safe deserialization.

There are already two system properties used for such purpose in Ignite:

/** Defines path to the file that contains list of classes allowed to safe deserialization.*/
public static final String IGNITE_MARSHALLER_WHITELIST = "IGNITE_MARSHALLER_WHITELIST";

/** Defines path to the file that contains list of classes disallowed to safe deserialization.*/
public static final String IGNITE_MARSHALLER_BLACKLIST = "IGNITE_MARSHALLER_BLACKLIST";

HTTP-REST should support these properties too.

 

Issue Links

• relates to: IGNITE-12857 Add ability to put non-primitive data types via HTTP-REST
• links to: GitHub Pull Request #7773
• links to: TC RunAll