Bastian Glöckle

Just for a quick illustration of the problem: Basically this is what happens: ``` public class CompletableFutureTest { public static void main(String[] args) throws InterruptedException { Executor executor = Executors.newSingleThreadScheduledExecutor();...

> @bgloeckle correct me if I'm wrong, but essentially what you're seeing is if the main thread gets to the thenCompose call after the future being composed is completed, CompletableFuture...

Sounds great :)

I think whitelisting the classes is the usual fix for this problem, so that should be good to go. Though I don't fully understand what you mean with "Serializing class...

Ok, I'm not 100% sure if I was clear enough about this, so just to be sure: The serialized stream of an AppendRequest for example would look like the following:...

Ah, wrong example. The AppendRequest will of course contain other CatalystSerializable objects as entries. But the idea of the example still works: Assume the Entry is a CommandEntry and that...

Yes, Serializable allows arbitrary classes to be loaded (if ObjectInputStream is not subclassed etc) and those arbitrary classes could execute code on instantiation that was received in the serialized stream...