JavaSerializer.ClassResolverObjectInputStream overrides resolveClass to resolve classes via the Wicket ClassResolvers. This does however not happen for resolveProxyClass.
An example of how this can go wrong:
- A page with a large component tree is deserialized (war).
- LinkedMap (used in MarkupContainer) is loaded in a parent ClassLoader (ear).
- Via this stack, a proxy is hit implementing Spring classes (from the war)
- Due to LinkedMap determining the latestUserDefinedLoader, the ear-loader is used for the lookup of this interface, which fails
Unfortunately, writing a testcase for this is not easy, so I only have a proposed fix: see the classloadingfix branch