Harden ZookeeperDistributedQueue against insecure deserialization (CWE-502)

[devin-ai-integration]

A Brief Overview

ZookeeperDistributedQueue.deserialize() called ObjectInputStream.readObject() on bytes read from Zookeeper with no class filtering, a classic insecure-deserialization vulnerability (CWE-502). If an attacker can influence data stored in Zookeeper, a gadget chain on the classpath could lead to Remote Code Execution.

This PR installs a JEP 290 ObjectInputFilter allowlist on the ObjectInputStream so only expected classes are ever resolved; everything else is rejected before its readObject runs. The project targets Java 17, so ObjectInputFilter is available natively (no new dependencies).

What changed

• deserialize() now sets an ObjectInputFilter on the stream before reading:

  ois = new ObjectInputStream(bais);
  ObjectInputFilter filter = getDeserializationFilter();
  if (filter != null) {
      ois.setObjectInputFilter(filter);
  }
  return ois.readObject();

• Default allowlist (DEFAULT_DESERIALIZATION_FILTER_PATTERN) permits JDK value types/collections (java.lang wrappers, java.util.*, java.time.*, java.math.*, java.lang.Object for the backing arrays of collections) plus org.broadleafcommerce.**, and ends in !* to reject everything else. It also sets resource limits (maxbytes, maxdepth, maxrefs, maxarray) to guard against DoS.
• getDeserializationFilter() lazily falls back to the default so deserialization can never silently run unfiltered; setDeserializationFilter(...) / setDeserializationFilterPattern(...) let applications extend the allowlist for custom Serializable queue element types.

Note: the allowlist matches by exact class name (not subtype), so the boxed wrapper types and java.lang.Object (collection backing arrays) are enumerated explicitly.

Tests

New ZookeeperDistributedQueueDeserializationTest (uses EasyMock partialMockBuilder to exercise the real serialize/deserialize without the Zookeeper-dependent constructor):

• allowlisted types (String, Integer, ArrayList) round-trip successfully;
• a non-allowlisted gadget stand-in (com.example.attack.MaliciousPayload, deliberately outside org.broadleafcommerce) is rejected with an InvalidClassException and its readObject never executes;
• a default filter is always present, and a custom pattern can opt a class back in.

Tests run: 4, Failures: 0, Errors: 0, Skipped: 0

Labels: Security, critical, ready-for-code-review

Additional context
Behavioral change: queue payloads outside the default allowlist (custom application Serializable types not under org.broadleafcommerce) will be rejected until added via setDeserializationFilterPattern(...). This is intentional fail-closed behavior.

Link to Devin session: https://app.devin.ai/sessions/e0ea74c3a36a4e11b3018a37d9f355d0

---

Devin Review

Status	Commit
⚪ Not started	—

Run Devin Review

[devin-ai-integration]

🤖 Devin AI Engineer

I'll be helping with this pull request! Here's what you should know:

✅ I will automatically:

• Address comments on this PR. Add '(aside)' to your comment to have me ignore it.
• Look at CI failures and help fix them

Note: I can only respond to comments from users who have write access to this repository.

⚙️ Control Options:

• Disable automatic comment, CI, and merge conflict monitoring