DefaultDeserializer should use ConfigurableObjectInputStream [SPR-13409]

[spring-projects-issues]

Rob Winch opened SPR-13409 and commented

It would be nice if DefaultDeserializer would use ConfigurableObjectInputStream with the ClassUtils.getDefaultClassLoader(). This would prevent issues with things like spring-boot/issues/3805

---

Affects: 4.2 GA

Reference URL: spring-projects/spring-boot#3805

Issue Links:

• DATAREDIS-427 Allow injecting deserializer for JdkSerializationRedisSerializer

Referenced from: commits d99717c

[spring-projects-issues]

Juergen Hoeller commented

I've revised DefaultDeserializer and DeserializingConverter to accept a given ClassLoader through an overloaded constructor.

ObjectInputStream itself actually uses the "latest user-defined ClassLoader", so I'm not keen on a hard override there. Allowing for an explicitly given ClassLoader seems to be the best compromise here.

Juergen