Introduced protections against deserialization attacks

paimon-flink/paimon-flink-common/pom.xml

@@ -169,6 +169,10 @@ under the License.
                 </exclusion>
             </exclusions>
         </dependency>
+        <dependency>
+            <groupId>io.github.pixee</groupId>
+            <artifactId>java-security-toolkit</artifactId>
+        </dependency>
     </dependencies>
 
     <build>

paimon-flink/paimon-flink-common/src/test/java/org/apache/paimon/flink/SchemaChangeSerializationTest.java

@@ -18,6 +18,7 @@
 
 package org.apache.paimon.flink;
 
+import io.github.pixee.security.ObjectInputFilters;
 import org.apache.paimon.schema.SchemaChange;
 import org.apache.paimon.types.DataTypes;
 
@@ -58,6 +59,7 @@ private void runTest(SchemaChange schemaChange) throws Exception {
 
         ByteArrayInputStream bais = new ByteArrayInputStream(bytes);
         ObjectInputStream ois = new ObjectInputStream(bais);
+        ObjectInputFilters.enableObjectFilterIfUnprotected(ois);
         Object actual = ois.readObject();
         assertThat(actual).isEqualTo(schemaChange);
     }

paimon-flink/pom.xml

@@ -185,4 +185,16 @@ under the License.
             </build>
         </profile>
     </profiles>
+    <dependencyManagement>
+        <dependencies>
+            <dependency>
+                <groupId>io.github.pixee</groupId>
+                <artifactId>java-security-toolkit</artifactId>
+                <version>${versions.java-security-toolkit}</version>
+            </dependency>
+        </dependencies>
+    </dependencyManagement>
+    <properties>
+        <versions.java-security-toolkit>1.2.0</versions.java-security-toolkit>
+    </properties>
 </project>

paimon-hive/paimon-hive-catalog/pom.xml

@@ -213,6 +213,10 @@ under the License.
             <type>jar</type>
             <scope>test</scope>
         </dependency>
+        <dependency>
+            <groupId>io.github.pixee</groupId>
+            <artifactId>java-security-toolkit</artifactId>
+        </dependency>
     </dependencies>
 
     <build>

paimon-hive/paimon-hive-catalog/src/main/java/org/apache/paimon/hive/SerializableHiveConf.java

@@ -18,6 +18,7 @@
 
 package org.apache.paimon.hive;
 
+import io.github.pixee.security.ObjectInputFilters;
 import org.apache.hadoop.hive.conf.HiveConf;
 
 import java.io.ByteArrayInputStream;
@@ -53,6 +54,7 @@ public HiveConf conf() {
     private void deSerializeConf() {
         try (ByteArrayInputStream bis = new ByteArrayInputStream(serializedConf);
                 ObjectInputStream ois = new ObjectInputStream(bis)) {
+            ObjectInputFilters.enableObjectFilterIfUnprotected(ois);
             this.conf = new HiveConf();
             conf.readFields(ois);
         } catch (IOException e) {

paimon-hive/paimon-hive-catalog/src/test/java/org/apache/paimon/hive/SerializableHiveConfTest.java

@@ -18,6 +18,7 @@
 
 package org.apache.paimon.hive;
 
+import io.github.pixee.security.ObjectInputFilters;
 import org.apache.hadoop.hive.conf.HiveConf;
 import org.junit.jupiter.api.Test;
 
@@ -48,6 +49,7 @@ public void testSerializeHiveConf() throws IOException, ClassNotFoundException {
         // deserialize
         ByteArrayInputStream bais = new ByteArrayInputStream(baos.toByteArray());
         ObjectInputStream ois = new ObjectInputStream(bais);
+        ObjectInputFilters.enableObjectFilterIfUnprotected(ois);
         SerializableHiveConf deserializedHiveConf = (SerializableHiveConf) ois.readObject();
         ois.close();
 

paimon-hive/paimon-hive-connector-common/pom.xml

@@ -581,6 +581,10 @@ under the License.
             </exclusions>
             <scope>test</scope>
         </dependency>
+        <dependency>
+            <groupId>io.github.pixee</groupId>
+            <artifactId>java-security-toolkit</artifactId>
+        </dependency>
     </dependencies>
 
     <build>

paimon-hive/paimon-hive-connector-common/src/main/java/org/apache/paimon/hive/mapred/PaimonOutputCommitter.java

@@ -18,6 +18,7 @@
 
 package org.apache.paimon.hive.mapred;
 
+import io.github.pixee.security.ObjectInputFilters;
 import org.apache.paimon.fs.FileIO;
 import org.apache.paimon.fs.Path;
 import org.apache.paimon.table.FileStoreTable;
@@ -273,6 +274,7 @@ private static void createPreCommitFile(
     private static List<CommitMessage> readPreCommitFile(Path location, FileIO io) {
         try (ObjectInputStream objectInputStream =
                 new ObjectInputStream(io.newInputStream(location))) {
+            ObjectInputFilters.enableObjectFilterIfUnprotected(objectInputStream);
             return (List<CommitMessage>) objectInputStream.readObject();
         } catch (ClassNotFoundException | IOException e) {
             throw new RuntimeException(

paimon-hive/pom.xml

@@ -50,6 +50,7 @@ under the License.
         <reflections.version>0.9.8</reflections.version>
         <aws.version>1.12.319</aws.version>
         <iceberg.flink.version>1.19</iceberg.flink.version>
+        <versions.java-security-toolkit>1.2.0</versions.java-security-toolkit>
     </properties>
 
     <dependencies>
@@ -130,5 +131,14 @@ under the License.
             <scope>test</scope>
         </dependency>
     </dependencies>
-
+    <dependencyManagement>
+        <dependencies>
+            <dependency>
+                <groupId>io.github.pixee</groupId>
+                <artifactId>java-security-toolkit</artifactId>
+
+                <version>${versions.java-security-toolkit}</version>
+            </dependency>
+        </dependencies>
+    </dependencyManagement>
 </project>

paimon-service/paimon-service-client/pom.xml

@@ -57,6 +57,10 @@ under the License.
             <artifactId>paimon-shade-guava-30</artifactId>
             <version>${paimon.shade.guava.version}-${paimon.shade.version}</version>
         </dependency>
+        <dependency>
+            <groupId>io.github.pixee</groupId>
+            <artifactId>java-security-toolkit</artifactId>
+        </dependency>
     </dependencies>
 
     <build>

paimon-service/paimon-service-client/src/main/java/org/apache/paimon/service/network/messages/MessageSerializer.java

@@ -18,6 +18,7 @@
 
 package org.apache.paimon.service.network.messages;
 
+import io.github.pixee.security.ObjectInputFilters;
 import org.apache.paimon.service.network.NetworkClient;
 import org.apache.paimon.service.network.NetworkServer;
 import org.apache.paimon.utils.Preconditions;
@@ -301,6 +302,7 @@ public static RequestFailure deserializeRequestFailure(final ByteBuf buf)
         Throwable cause;
         try (ByteBufInputStream bis = new ByteBufInputStream(buf);
                 ObjectInputStream in = new ObjectInputStream(bis)) {
+            ObjectInputFilters.enableObjectFilterIfUnprotected(in);
             cause = (Throwable) in.readObject();
         }
         return new RequestFailure(requestId, cause);
@@ -321,6 +323,7 @@ public static Throwable deserializeServerFailure(final ByteBuf buf)
             throws IOException, ClassNotFoundException {
         try (ByteBufInputStream bis = new ByteBufInputStream(buf);
                 ObjectInputStream in = new ObjectInputStream(bis)) {
+            ObjectInputFilters.enableObjectFilterIfUnprotected(in);
             return (Throwable) in.readObject();
         }
     }

paimon-service/pom.xml

@@ -37,4 +37,16 @@ under the License.
         <module>paimon-service-client</module>
         <module>paimon-service-runtime</module>
     </modules>
+    <dependencyManagement>
+        <dependencies>
+            <dependency>
+                <groupId>io.github.pixee</groupId>
+                <artifactId>java-security-toolkit</artifactId>
+                <version>${versions.java-security-toolkit}</version>
+            </dependency>
+        </dependencies>
+    </dependencyManagement>
+    <properties>
+        <versions.java-security-toolkit>1.2.0</versions.java-security-toolkit>
+    </properties>
 </project>