Prevent class with empty Java package being trusted by SpecificDatumR…

…eader (#3311)
apache · Feb 14, 2025 · 3455827 · 3455827
1 parent d5a0ebd
commit 3455827
Showing 1 changed file with 4 additions and 4 deletions.
diff --git a/lang/java/avro/src/main/java/org/apache/avro/specific/SpecificDatumReader.java b/lang/java/avro/src/main/java/org/apache/avro/specific/SpecificDatumReader.java
@@ -141,10 +141,10 @@ private void checkSecurity(Class clazz) throws ClassNotFoundException {
           break;
         }
       }
-      if (!found) {
-        throw new SecurityException("Forbidden " + clazz
-            + "! This class is not trusted to be included in Avro schema using java-class. Please set org.apache.avro.SERIALIZABLE_PACKAGES system property with the packages you trust.");
-      }
+    }
+    if (!found) {
+      throw new SecurityException("Forbidden " + clazz
+          + "! This class is not trusted to be included in Avro schema using java-class. Please set org.apache.avro.SERIALIZABLE_PACKAGES system property with the packages you trust.");
     }
   }