[LUCENE-9094] Ban ObjectInputStream and ObjectOutputStream in forbidden-apis

• Type: Task
• Status: Closed
• Priority: Major
• Resolution: Fixed
• Fix Version/s: 8.5
• Component/s: general/build
• Lucene Fields: New
• Assignee: Robert Muir
• Reporter: Robert Muir
• Created: 16/Dec/19 12:31
• Updated: 28/Aug/22 15:54
• Resolved: 16/Dec/19 18:57

Description

suggested build failure message:

[forbidden-apis] Forbidden class/interface use: java.io.ObjectInputStream [Java deserialization is unsafe when the data is untrusted. The java developer is powerless: no checks or casts help, exploitation can happen in places such as clinit or finalize!]

I will whitelist existing places doing this for now.

Issue Links

• is related to: LUCENE-9095 remove java serialization from lucene/replicator
• is related to: SOLR-14095 Replace Java serialization with Javabin in Overseer operations
• relates to: SOLR-14117 remove java serialization from AnalyticsShardResponseParser.java