Marcelo Vanzin 8efc6e9865 [SPARK-20922][CORE] Add whitelist of classes that can be deserialized by the launcher. ... Blindly deserializing classes using Java serialization opens the code up to issues in other libraries, since just deserializing data from a stream may end up execution code (think readObject()). Since the launcher protocol is pretty self-contained, there's just a handful of classes it legitimately needs to deserialize, and they're in just two packages, so add a filter that throws errors if classes from any other package show up in the stream. This also maintains backwards compatibility (the updated launcher code can still communicate with the backend code in older Spark releases). Tested with new and existing unit tests. Author: Marcelo Vanzin <vanzin@cloudera.com> Closes #18166 from vanzin/SPARK-20922.		2017-06-01 14:44:34 -07:00
..
src	[SPARK-20922][CORE] Add whitelist of classes that can be deserialized by the launcher.	2017-06-01 14:44:34 -07:00
pom.xml	[SPARK-20453] Bump master branch version to 2.3.0-SNAPSHOT	2017-04-24 21:48:04 -07:00