(avro) branch main updated: Prevent class with empty Java package being trusted by SpecificDatumReader (#3311)

[mgrigorov]

This is an automated email from the ASF dual-hosted git repository.

mgrigorov pushed a commit to branch main
in repository https://gitbox.apache.org/repos/asf/avro.git


The following commit(s) were added to refs/heads/main by this push:
     new 345582734 Prevent class with empty Java package being trusted by 
SpecificDatumReader (#3311)
345582734 is described below

commit 34558273491dbaede744dfb9319759125118356c
Author: Michal Foksa <git...@michalfoksa.net>
AuthorDate: Fri Feb 14 10:11:43 2025 +0100

    Prevent class with empty Java package being trusted by SpecificDatumReader 
(#3311)
---
 .../main/java/org/apache/avro/specific/SpecificDatumReader.java   | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git 
a/lang/java/avro/src/main/java/org/apache/avro/specific/SpecificDatumReader.java
 
b/lang/java/avro/src/main/java/org/apache/avro/specific/SpecificDatumReader.java
index 8950f1659..e782c58c8 100644
--- 
a/lang/java/avro/src/main/java/org/apache/avro/specific/SpecificDatumReader.java
+++ 
b/lang/java/avro/src/main/java/org/apache/avro/specific/SpecificDatumReader.java
@@ -141,10 +141,10 @@ public class SpecificDatumReader<T> extends 
GenericDatumReader<T> {
           break;
         }
       }
-      if (!found) {
-        throw new SecurityException("Forbidden " + clazz
-            + "! This class is not trusted to be included in Avro schema using 
java-class. Please set org.apache.avro.SERIALIZABLE_PACKAGES system property 
with the packages you trust.");
-      }
+    }
+    if (!found) {
+      throw new SecurityException("Forbidden " + clazz
+          + "! This class is not trusted to be included in Avro schema using 
java-class. Please set org.apache.avro.SERIALIZABLE_PACKAGES system property 
with the packages you trust.");
     }
   }