{"action":"created","issue":{"url":"https://api.github.com/repos/pac4j/play-pac4j/issues/252","repository_url":"https://api.github.com/repos/pac4j/play-pac4j","labels_url":"https://api.github.com/repos/pac4j/play-pac4j/issues/252/labels{/name}","comments_url":"https://api.github.com/repos/pac4j/play-pac4j/issues/252/comments","events_url":"https://api.github.com/repos/pac4j/play-pac4j/issues/252/events","html_url":"https://github.com/pac4j/play-pac4j/issues/252","id":384685821,"node_id":"MDU6SXNzdWUzODQ2ODU4MjE=","number":252,"title":"PlayCookieSessionStore: can't save custom class due to \"untrusted package error\"","user":{"login":"unkarjedy","id":3989292,"node_id":"MDQ6VXNlcjM5ODkyOTI=","avatar_url":"https://avatars2.githubusercontent.com/u/3989292?v=4","gravatar_id":"","url":"https://api.github.com/users/unkarjedy","html_url":"https://github.com/unkarjedy","followers_url":"https://api.github.com/users/unkarjedy/followers","following_url":"https://api.github.com/users/unkarjedy/following{/other_user}","gists_url":"https://api.github.com/users/unkarjedy/gists{/gist_id}","starred_url":"https://api.github.com/users/unkarjedy/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/unkarjedy/subscriptions","organizations_url":"https://api.github.com/users/unkarjedy/orgs","repos_url":"https://api.github.com/users/unkarjedy/repos","events_url":"https://api.github.com/users/unkarjedy/events{/privacy}","received_events_url":"https://api.github.com/users/unkarjedy/received_events","type":"User","site_admin":false},"labels":[{"id":18903558,"node_id":"MDU6TGFiZWwxODkwMzU1OA==","url":"https://api.github.com/repos/pac4j/play-pac4j/labels/enhancement","name":"enhancement","color":"84b6eb","default":true}],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":{"url":"https://api.github.com/repos/pac4j/play-pac4j/milestones/27","html_url":"https://github.com/pac4j/play-pac4j/milestone/27","labels_url":"https://api.github.com/repos/pac4j/play-pac4j/milestones/27/labels","id":3527847,"node_id":"MDk6TWlsZXN0b25lMzUyNzg0Nw==","number":27,"title":"7.0.0","description":null,"creator":{"login":"leleuj","id":1038508,"node_id":"MDQ6VXNlcjEwMzg1MDg=","avatar_url":"https://avatars1.githubusercontent.com/u/1038508?v=4","gravatar_id":"","url":"https://api.github.com/users/leleuj","html_url":"https://github.com/leleuj","followers_url":"https://api.github.com/users/leleuj/followers","following_url":"https://api.github.com/users/leleuj/following{/other_user}","gists_url":"https://api.github.com/users/leleuj/gists{/gist_id}","starred_url":"https://api.github.com/users/leleuj/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/leleuj/subscriptions","organizations_url":"https://api.github.com/users/leleuj/orgs","repos_url":"https://api.github.com/users/leleuj/repos","events_url":"https://api.github.com/users/leleuj/events{/privacy}","received_events_url":"https://api.github.com/users/leleuj/received_events","type":"User","site_admin":false},"open_issues":1,"closed_issues":1,"state":"open","created_at":"2018-07-27T11:51:32Z","updated_at":"2018-11-27T10:53:18Z","due_on":null,"closed_at":null},"comments":5,"created_at":"2018-11-27T08:55:55Z","updated_at":"2018-11-27T15:06:34Z","closed_at":null,"author_association":"CONTRIBUTOR","body":"Yesterday I tried to move from `PlayCacheSessionStore` to `PlayCookieSessionStore` in order to make our server session-stateless.  Our session contais quite a lightweight user info as a instance of case class. It is saved via  `PlayCookieSessionStore.set` with key `pac4j_pac4jUserProfiles`.\r\nBut unfortunately `null` is returned when `PlayCookieSessionStore.get` is called for the same key.\r\n\r\nMinimum Complete and Verifiable Example:\r\n```scala\r\npackage _scala_interestings\r\n\r\nimport org.pac4j.play.PlayWebContext\r\nimport org.pac4j.play.store.PlayCookieSessionStore\r\nimport play.core.j.JavaHelpers\r\nimport play.mvc.Http\r\nimport play.mvc.Http.RequestBuilder\r\n\r\nobject PlayCookieSessionStoreTest {\r\n\r\n  case class User(firstName: String, lastName: String)\r\n\r\n  def main(args: Array[String]): Unit = {\r\n    val sessionStore = new PlayCookieSessionStore()\r\n    val httpContext = new Http.Context(new RequestBuilder(), JavaHelpers.createContextComponents())\r\n    val context = new PlayWebContext(httpContext, sessionStore)\r\n\r\n    println(\"Test 1: set/get string. Everything is OK\")\r\n    val key1 = \"key1\"\r\n    val string = \"just simple string\"\r\n    sessionStore.set(context, key1, string)\r\n    println(sessionStore.get(context, key1))\r\n\r\n    println(\"Test 2: set/get string. Retrieved value is NULL!\")\r\n    val key2 = \"key2\"\r\n    val profile = User(\"firstName\", \"lastName\")\r\n    sessionStore.set(context, key2, profile)\r\n    println(sessionStore.get(context, key2))\r\n  }\r\n\r\n}\r\n```\r\n\r\n\r\n\r\nI found the root of the issue. `PlayCookiesessionStore` has following field:\r\n```java\r\n public static final JavaSerializationHelper JAVA_SER_HELPER = new JavaSerializationHelper();\r\n```\r\nMethod `JavaSerializationHelper.unserializeFromBytes` is used inside `PlayCookiesessionStore.get`. Inside that method a special list is used:\r\n```java\r\nprivate List<String> trustedPackages;\r\n```\r\nthat is initialized in the following way:\r\n```java\r\n    public JavaSerializationHelper() {\r\n        trustedPackages = new ArrayList<>();\r\n        trustedPackages.addAll(Arrays.asList(\"java.\", \"javax.\", \"org.pac4j.\", \"com.github.scribejava.\", \"org.opensaml.\", \"com.nimbusds.\",\r\n            \"org.joda.\", \"net.minidev.json.\", \"org.bson.types.\"));\r\n    }\r\n```\r\nThe list of trusted packages does not contain our app package, thus it does not work as we expect.\r\n"},"comment":{"url":"https://api.github.com/repos/pac4j/play-pac4j/issues/comments/442091545","html_url":"https://github.com/pac4j/play-pac4j/issues/252#issuecomment-442091545","issue_url":"https://api.github.com/repos/pac4j/play-pac4j/issues/252","id":442091545,"node_id":"MDEyOklzc3VlQ29tbWVudDQ0MjA5MTU0NQ==","user":{"login":"leleuj","id":1038508,"node_id":"MDQ6VXNlcjEwMzg1MDg=","avatar_url":"https://avatars1.githubusercontent.com/u/1038508?v=4","gravatar_id":"","url":"https://api.github.com/users/leleuj","html_url":"https://github.com/leleuj","followers_url":"https://api.github.com/users/leleuj/followers","following_url":"https://api.github.com/users/leleuj/following{/other_user}","gists_url":"https://api.github.com/users/leleuj/gists{/gist_id}","starred_url":"https://api.github.com/users/leleuj/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/leleuj/subscriptions","organizations_url":"https://api.github.com/users/leleuj/orgs","repos_url":"https://api.github.com/users/leleuj/repos","events_url":"https://api.github.com/users/leleuj/events{/privacy}","received_events_url":"https://api.github.com/users/leleuj/received_events","type":"User","site_admin":false},"created_at":"2018-11-27T15:06:34Z","updated_at":"2018-11-27T15:06:34Z","author_association":"MEMBER","body":"About the trusted packages, I'm globally in line with the proposed changes, except that we can't break backward compatibility. So we must keep the list instead of a set in the 3.5.x version and return a mutable list, but we should mark the getter and setter methods with `@Deprecated` and add a new `addTrustedPackages` method.\r\n\r\nIn the version 4.0.x, we'll be able to change that and use a set and return an immutable set in a getter.\r\n\r\nLet's prepare a first PR for the current master (3.5.x) in that way.\r\n"}}
{"actor":{"display_login":"leleuj"}}