[WICKET-6353] Proxy deserialization fails due to classloading issues

• Type: Bug
• Status: Resolved
• Priority: Major
• Resolution: Fixed
• Affects Version/s: 7.6.0
• Fix Version/s: 7.7.0, 8.0.0-M6
• Component/s: wicket
• Assignee: Emond Papegaaij
• Reporter: Emond Papegaaij
• Created: 05/Apr/17 12:54
• Updated: 13/Apr/17 07:29
• Resolved: 13/Apr/17 07:29

Description

JavaSerializer.ClassResolverObjectInputStream overrides resolveClass to resolve classes via the Wicket ClassResolvers. This does however not happen for resolveProxyClass.

An example of how this can go wrong:

• A page with a large component tree is deserialized (war).
• LinkedMap (used in MarkupContainer) is loaded in a parent ClassLoader (ear).
• Via this stack, a proxy is hit implementing Spring classes (from the war)
• Due to LinkedMap determining the latestUserDefinedLoader, the ear-loader is used for the lookup of this interface, which fails

Unfortunately, writing a testcase for this is not easy, so I only have a proposed fix: see the classloadingfix branch