[AliRana30]

What changes?

1. ObjectFileSerialization:
   • Adds createObjectInputFilter(Class<?> elementType) to restrict legacy object deserialization to expected primitives, wrappers, standard safe collections, Wayang types, Scala tuples, and expected elementType hierarchies.
   • Adds dynamic allowlist pattern configuration via wayang.basic.serialization.allowlist.
   • Rejects unauthorized classes with InvalidClassException.
2. WayangValue:
   • Enforces the ObjectInputFilter on Flink criterion deserialization.
   • Refactors convertToByte and convertToObject to use try-with-resources.
3. Tests:
   • Added unit test cases to verify rejection of disallowed classes, explicit elementType acceptance, and system property pattern matching.

Why are the changes needed?

Directly calling ObjectInputStream.readObject() without an ObjectInputFilter allows arbitrary class instantiation, posing a deserialization security risk (CWE-502).

How was this tested?

• Unit tests added to ObjectFileSerializationTest and WayangValueTest.
• Ran mvn test on wayang-basic and wayang-flink.
• Ran mvn apache-rat:check.

Closes : #835

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.

[AliRana30]

@zkaoudi Pr is up for your review.

[novatechflow]

Thanks for the fix. Three issues to address before merging:

• The allowlist accepts arbitrary Number, Collection, and Map subclasses. Custom readObject() hooks still execute.
• A fresh WayangValue rejects valid custom payloads and silently returns null because the expected type comes from previous data.
• List.of(), Set.of(), and Map.of() fail deserialization because java.util.CollSer is missing.

Reproduced all three on Java 17. Please tighten the allowlist and add regression tests.

[AliRana30]

@novatechflow Updated the allowlist and WayangValue as per the feedback. Alos added regression tests for all three cases in ObjectFileSerializationTest and WayangValueTest. Verified clean build on Java 17