Deserialization blocklist logs WARNs for classes Jira's exemption later allows, flooding the log

XMLWordPrintable

    • Type: Bug
    • Resolution: Unresolved
    • Priority: Medium
    • None
    • Affects Version/s: 11.1.1
    • Component/s: Data Center - Index
    • None
    • 11.01
    • 1
    • Severity 3 - Minor

      Issue Summary

      This bug do not interfere with cache replication. This is only polluting logs. 

       

      BlocklistFilteringFunction.apply logs Deserialize or execute step prevented for class: X and then returns its verdict. Jira composes the filter as blocklist.or(exemption), so the warning is emitted before Predicate.or consults the exemption. Every class the exemption goes on to allow is warned about anyway.

      Each RMI cache-peer registry lookup therefore emits four warnings for classes that are immediately permitted: jdk.proxyN.$ProxyN, java.lang.reflect.Proxy, java.rmi.server.RemoteObjectInvocationHandler, java.rmi.server.RemoteObject. This happens on healthy clusters as well, which is why these lines are routinely misread as evidence of a fault.

      Steps to Reproduce

      1. Run Jira  DC in cluster mode, at least 2 nodes
      2. observe logs

      Expected Results

      Logs do not have warnings 

      Actual Results

       

       2026-09-09 07:28:36,851+0000 localq-reader-1 WARN      [c.a.security.serialblocklist.BlocklistFilteringFunction] Deserialize or execute step prevented for class: jdk.proxy3.$Proxy134                         
        2026-09-09 07:28:36,852+0000 localq-reader-1 WARN      [c.a.security.serialblocklist.BlocklistFilteringFunction] Deserialize or execute step prevented for class: java.lang.reflect.Proxy                      
        2026-09-09 07:28:36,853+0000 localq-reader-1 WARN      [c.a.security.serialblocklist.BlocklistFilteringFunction] Deserialize or execute step prevented for class: java.rmi.server.RemoteObjectInvocationHandler
        2026-09-09 07:28:36,853+0000 localq-reader-1 WARN      [c.a.security.serialblocklist.BlocklistFilteringFunction] Deserialize or execute step prevented for class: java.rmi.server.RemoteObject                 
       

      Workaround

      Currently there is no known workaround for this behavior. A workaround will be added here when available

              Assignee:
              Natalia Wroblewska
              Reporter:
              Natalia Wroblewska
              Votes:
              1 Vote for this issue
              Watchers:
              3 Start watching this issue

                Created:
                Updated: