Fix insecure deserialization in ZookeeperDistributedQueue (CWE-502)

[devin-ai-integration]

Fix insecure deserialization in ZookeeperDistributedQueue (CWE-502)

A Brief Overview
ZookeeperDistributedQueue.deserialize() uses ObjectInputStream.readObject() on data from Zookeeper without any class filtering or validation. This is a well-known insecure deserialization vulnerability (CWE-502) that can lead to Remote Code Execution (RCE) if an attacker can influence the data stored in Zookeeper.

This PR adds an ObjectInputFilter (Java 9+ API) to the deserialize() method that restricts deserialization to an allowlist of known safe classes:

• org.broadleafcommerce.** — all Broadleaf Commerce domain types (including SolrUpdateCommand and subclasses)
• org.apache.solr.** — Solr types required by IncrementalUpdateCommand (SolrInputDocument, SolrInputField, etc.)
• java.lang.* — standard Java types (Integer, String, etc.)
• java.util.* — standard collections
• java.io.Serializable — the serialization marker interface
• java.math.* — BigDecimal, BigInteger
• java.time.* — temporal types

All other classes are rejected (!*), preventing gadget-chain attacks via malicious serialized payloads.

Labels: Security, critical, ready-for-code-review

Additional context

• The filter pattern string uses ObjectInputFilter.Config.createFilter() which is a stable API since Java 9 and well-suited for the project's Java 17 target.
• The deserialize() method is called in two places: once for queue element data (line 652, typed as T extends Serializable) and once for config data (line 794, cast to Integer). Both are covered by the allowlist.
• org.apache.solr.** is required because IncrementalUpdateCommand contains List<SolrInputDocument> fields that must be permitted during deserialization.
• This is a minimal, targeted fix that does not change behavior for legitimate payloads.

Link to Devin session: https://app.devin.ai/sessions/8ebbbcec22c7462b80e77373ea7926a8
Requested by: @Colhodm

---

Devin Review

Status	Commit
⚪ Not started	—

💡 Connect your GitHub account to enable automatic code reviews.

---

[devin-ai-integration]

🤖 Devin AI Engineer

I'll be helping with this pull request! Here's what you should know:

✅ I will automatically:

• Address comments on this PR. Add '(aside)' to your comment to have me ignore it.
• Look at CI failures and help fix them

Note: I can only respond to comments from users who have write access to this repository.

⚙️ Control Options:

• Disable automatic comment and CI monitoring