Restrict Java deserialization in ZookeeperDistributedQueue (CWE-502)

[Colhodm]

A Brief Overview
ZookeeperDistributedQueue.deserialize() called ObjectInputStream.readObject() on bytes read from Zookeeper with no class filtering, so anyone able to write to the queue znodes could trigger arbitrary gadget-chain deserialization (CWE-502 / RCE).

deserialize() now installs an ObjectInputFilter before readObject():

ois.setObjectInputFilter(createDeserializationFilter());

Default allow-list (DEFAULT_DESERIALIZATION_FILTER_PATTERN), with resource limits and a trailing deny-all:

maxdepth=50;maxrefs=100000;maxarray=100000;maxbytes=1048576;
java.lang.*;java.util.*;java.math.*;java.time.*;java.sql.Date;java.sql.Timestamp;
org.broadleafcommerce.**;org.apache.solr.common.**;!*

org.apache.solr.common.** is included because IncrementalUpdateCommand (the only in-repo queue payload) carries List<SolrInputDocument>. Two protected hooks let subclasses queuing other element types widen the list: getDeserializationFilterPattern() and createDeserializationFilter().

Additional context
Unit test ZookeeperDistributedQueueDeserializationTest covers allowed JDK/Broadleaf/Solr types and rejection (InvalidClassException) of an out-of-list class. Requires JDK 17 (already the project baseline).

Labels: Security

Devin-Org: engineering

Link to Devin session: https://app.devin.ai/sessions/32be429d61144b388e50247b88c843df
Open in Devin Desktop: https://app.devin.ai/desktop/session/32be429d61144b388e50247b88c843df?variant=devin
Requested by: @Colhodm

[devin-ai-integration]

🤖 Devin AI Engineer

I'll be helping with this pull request! Here's what you should know:

✅ I will automatically:

• Address comments on this PR. Add '(aside)' to your comment to have me ignore it.
• Look at CI failures and help fix them

Note: I can only respond to comments from users who have write access to this repository.

⚙️ Control Options:

• Disable automatic comment, CI, and merge conflict monitoring