Skip to content

Commit bd916d3

Browse files
iemejiaiemejia
authored
AVRO-4189: [Java] Use ClassUtils.forName() in FastReaderBuilder for consistency (#3693)
FastReaderBuilder.findClass() was using data.getClassLoader().loadClass() directly, bypassing ClassUtils.forName() which is used everywhere else in the codebase. This change aligns FastReaderBuilder with the standard class loading path and adds tests for class loading behavior.
1 parent a146597 commit bd916d3

3 files changed

Lines changed: 146 additions & 2 deletions

File tree

‎lang/java/avro/src/main/java/org/apache/avro/io/FastReaderBuilder.java‎

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -52,6 +52,7 @@
5252
import org.apache.avro.reflect.ReflectionUtil;
5353
import org.apache.avro.specific.SpecificData;
5454
import org.apache.avro.specific.SpecificRecordBase;
55+
import org.apache.avro.util.ClassUtils;
5556
import org.apache.avro.util.Utf8;
5657
import org.apache.avro.util.WeakIdentityHashMap;
5758
import org.apache.avro.util.internal.Accessor;
@@ -446,8 +447,8 @@ private FieldReader getTransformingStringReader(String valueClass, FieldReader s
446447

447448
private Optional<Class<?>> findClass(String clazz) {
448449
try {
449-
return Optional.of(data.getClassLoader().loadClass(clazz));
450-
} catch (ReflectiveOperationException e) {
450+
return Optional.of(ClassUtils.forName(data.getClassLoader(), clazz));
451+
} catch (ClassNotFoundException e) {
451452
return Optional.empty();
452453
}
453454
}

‎lang/java/avro/src/test/java/org/apache/avro/io/TestFastReaderBuilderClassLoading.java‎

Lines changed: 120 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,120 @@
1+
/*
2+
* Licensed to the Apache Software Foundation (ASF) under one
3+
* or more contributor license agreements. See the NOTICE file
4+
* distributed with this work for additional information
5+
* regarding copyright ownership. The ASF licenses this file
6+
* to you under the Apache License, Version 2.0 (the
7+
* "License"); you may not use this file except in compliance
8+
* with the License. You may obtain a copy of the License at
9+
*
10+
* https://www.apache.org/licenses/LICENSE-2.0
11+
*
12+
* Unless required by applicable law or agreed to in writing, software
13+
* distributed under the License is distributed on an "AS IS" BASIS,
14+
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
15+
* See the License for the specific language governing permissions and
16+
* limitations under the License.
17+
*/
18+
package org.apache.avro.io;
19+
20+
import static org.junit.jupiter.api.Assertions.*;
21+
22+
import java.io.ByteArrayInputStream;
23+
import java.io.ByteArrayOutputStream;
24+
import java.io.IOException;
25+
import java.net.URI;
26+
import java.util.Collections;
27+
28+
import org.apache.avro.Schema;
29+
import org.apache.avro.generic.GenericData;
30+
import org.apache.avro.generic.GenericDatumReader;
31+
import org.apache.avro.generic.GenericDatumWriter;
32+
import org.apache.avro.generic.GenericRecord;
33+
import org.apache.avro.generic.GenericRecordBuilder;
34+
import org.apache.avro.specific.SpecificData;
35+
import org.apache.avro.util.ClassSecurityValidator;
36+
import org.apache.avro.util.ClassSecurityValidator.ClassSecurityPredicate;
37+
import org.junit.jupiter.api.AfterEach;
38+
import org.junit.jupiter.api.BeforeEach;
39+
import org.junit.jupiter.api.Test;
40+
41+
/**
42+
* Tests that FastReaderBuilder.findClass() routes class loading through
43+
* ClassUtils.forName(), so that ClassSecurityValidator is applied consistently.
44+
*/
45+
public class TestFastReaderBuilderClassLoading {
46+
47+
private static final String TEST_VALUE = "https://example.com";
48+
49+
private ClassSecurityPredicate originalValidator;
50+
51+
@BeforeEach
52+
public void saveValidator() {
53+
originalValidator = ClassSecurityValidator.getGlobal();
54+
}
55+
56+
@AfterEach
57+
public void restoreValidator() {
58+
ClassSecurityValidator.setGlobal(originalValidator);
59+
}
60+
61+
/**
62+
* When the validator blocks a class referenced by java-class, FastReaderBuilder
63+
* must propagate the SecurityException so the caller knows why the class was
64+
* rejected.
65+
*/
66+
@Test
67+
void blockedClassThrowsSecurityException() {
68+
// Block java.net.URI
69+
ClassSecurityValidator.setGlobal(ClassSecurityValidator.composite(ClassSecurityValidator.DEFAULT_TRUSTED_CLASSES,
70+
ClassSecurityValidator.builder().add("org.apache.avro.util.Utf8").build()));
71+
72+
assertThrows(SecurityException.class, () -> readWithJavaClass("java.net.URI"),
73+
"Blocked class should cause a SecurityException to propagate");
74+
}
75+
76+
/**
77+
* When the validator trusts a class referenced by java-class, FastReaderBuilder
78+
* should instantiate it normally.
79+
*/
80+
@Test
81+
void trustedClassIsInstantiated() {
82+
ClassSecurityValidator.setGlobal(ClassSecurityValidator.composite(ClassSecurityValidator.DEFAULT_TRUSTED_CLASSES,
83+
ClassSecurityValidator.builder().add("java.net.URI").add("org.apache.avro.util.Utf8").build()));
84+
85+
GenericRecord result = readWithJavaClass("java.net.URI");
86+
87+
assertInstanceOf(URI.class, result.get("value"));
88+
assertEquals(URI.create(TEST_VALUE), result.get("value"));
89+
}
90+
91+
/**
92+
* Encode a string, then read it back through FastReaderBuilder with the given
93+
* java-class.
94+
*/
95+
private GenericRecord readWithJavaClass(String javaClass) {
96+
try {
97+
Schema stringSchema = Schema.create(Schema.Type.STRING);
98+
stringSchema.addProp(SpecificData.CLASS_PROP, javaClass);
99+
stringSchema.addProp(GenericData.STRING_PROP, GenericData.StringType.String.name());
100+
101+
Schema recordSchema = Schema.createRecord("TestRecord", null, "test", false);
102+
recordSchema.setFields(Collections.singletonList(new Schema.Field("value", stringSchema, null, null)));
103+
104+
// Encode
105+
GenericRecord record = new GenericRecordBuilder(recordSchema).set("value", TEST_VALUE).build();
106+
ByteArrayOutputStream out = new ByteArrayOutputStream();
107+
Encoder encoder = EncoderFactory.get().binaryEncoder(out, null);
108+
new GenericDatumWriter<GenericRecord>(recordSchema).write(record, encoder);
109+
encoder.flush();
110+
111+
// Decode with fast reader enabled
112+
GenericData data = new GenericData();
113+
data.setFastReaderEnabled(true);
114+
GenericDatumReader<GenericRecord> reader = new GenericDatumReader<>(recordSchema, recordSchema, data);
115+
return reader.read(null, DecoderFactory.get().binaryDecoder(new ByteArrayInputStream(out.toByteArray()), null));
116+
} catch (IOException e) {
117+
return fail("Unexpected IOException during encode/decode", e);
118+
}
119+
}
120+
}

‎lang/java/avro/src/test/java/org/apache/avro/util/TestClassSecurityValidator.java‎

Lines changed: 23 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -97,6 +97,29 @@ public void forbiddenClass(String className) {
9797
assertEquals("Not inner", e.getMessage());
9898
}
9999

100+
@Test
101+
void testClassUtilsEnforcesValidator() {
102+
ClassSecurityValidator.setGlobal(ClassSecurityValidator.builder().add("java.lang.String").build());
103+
104+
assertThrows(SecurityException.class, () -> ClassUtils.forName("java.net.URI"),
105+
"ClassUtils.forName should reject classes not in the trusted set");
106+
107+
assertDoesNotThrow(() -> ClassUtils.forName("java.lang.String"),
108+
"ClassUtils.forName should allow classes in the trusted set");
109+
}
110+
111+
@Test
112+
void testDirectLoadClassDoesNotUseValidator() throws ClassNotFoundException {
113+
ClassSecurityValidator.setGlobal(ClassSecurityValidator.builder().add("java.lang.String").build());
114+
115+
ClassLoader cl = Thread.currentThread().getContextClassLoader();
116+
Class<?> loaded = cl.loadClass("java.net.URI");
117+
assertNotNull(loaded, "Direct ClassLoader.loadClass() loads any class regardless of the validator");
118+
119+
assertThrows(SecurityException.class, () -> ClassUtils.forName("java.net.URI"),
120+
"ClassUtils.forName correctly applies the validator");
121+
}
122+
100123
@Test
101124
void testBuildComplexPredicate() {
102125
ClassSecurityValidator.setGlobal(ClassSecurityValidator.composite(

0 commit comments

Comments
 (0)