Add process-wide ObjectInputFilter to reject Java deserialization by default - #22073

Merged

cwperks merged 4 commits into

opensearch-project:mainfrom

cwperks:object-input-filter

Jun 18, 2026

Commits on Jun 3, 2026

Extend forbidden api for java serialization from build-time only to also enforce at runtime
cwperks
committed
d6224f9

Commits on Jun 5, 2026

Add more tests
cwperks
committed
2e6eb10

Commits on Jun 9, 2026

Put new logic behind feature flag disabled by default for bwc
cwperks
committed
876ec79

Commits on Jun 18, 2026

Merge branch 'main' into object-input-filter
sandeshkr419
authored
aca4592