bug: restrict Java deserialization in ZookeeperDistributedQueue (CWE-502)

[Colhodm]

Restricting Java deserialization in ZookeeperDistributedQueue
Fixes an insecure deserialization (CWE-502) vulnerability where ZookeeperDistributedQueue.deserialize() called ObjectInputStream.readObject() on Zookeeper-sourced bytes without any class filtering, enabling RCE via gadget chains if an attacker can write to the queue znodes.

A Brief Overview
deserialize() now installs an ObjectInputFilter (JDK 9+) on the ObjectInputStream:

ois.setObjectInputFilter(getDeserializationFilter());

The filter:

• rejects streams with depth > 64, references > 10000, or arrays > 100000 elements
• unwraps array component types; primitives are allowed
• allows only class names in getAllowedDeserializationClasses() (String, boxed primitives, BigDecimal/BigInteger, Date, UUID, common java.util collections) or starting with a prefix in getAllowedDeserializationPackagePrefixes() (org.broadleafcommerce., java.util.Collections$, java.util.ImmutableCollections$)
• rejects everything else; the JDK raises InvalidClassException, which the existing catch wraps in DistributedQueueException

Both getters are protected so subclasses that queue other payload types can widen the allowlist. The only in-repo user (DefaultSolrIndexQueueProvider) queues SolrUpdateCommand subclasses, which are covered by the org.broadleafcommerce. prefix.

Added ZookeeperDistributedQueueDeserializationTest covering allowed round-trips (Integer, String, ArrayList, Broadleaf-package class) and rejection of a non-allowlisted class.

Additional context
Labels: Security, Bug, Severity: critical. Verified with mvn -pl core/broadleaf-framework -am test -Dtest=ZookeeperDistributedQueueDeserializationTest (2 tests pass) and module compile.

Devin-Org: engineering

Link to Devin session: https://app.devin.ai/sessions/94e302ce85d0462e89df7ed67c4281da
Open in Devin Desktop: https://app.devin.ai/desktop/session/94e302ce85d0462e89df7ed67c4281da?variant=devin
Requested by: @Colhodm

[devin-ai-integration]

🤖 Devin AI Engineer

I'll be helping with this pull request! Here's what you should know:

✅ I will automatically:

• Address comments on this PR. Add '(aside)' to your comment to have me ignore it.
• Look at CI failures and help fix them

Note: I can only respond to comments from users who have write access to this repository.

⚙️ Control Options:

• Disable automatic comment, CI, and merge conflict monitoring