From 56539759161de46cdf2e439597f3c6aa5febf0ee Mon Sep 17 00:00:00 2001
From: Craig Perkins <cwperx@amazon.com>
Date: Wed, 6 May 2026 15:08:20 -0400
Subject: [PATCH] Cleanup SafeSerializationUtils to remove unused Guava classes

Signed-off-by: Craig Perkins <cwperx@amazon.com>
---
 .../org/opensearch/security/support/Base64Helper.java  |  2 ++
 .../security/support/SafeSerializationUtils.java       | 10 ++--------
 2 files changed, 4 insertions(+), 8 deletions(-)

diff --git a/src/main/java/org/opensearch/security/support/Base64Helper.java b/src/main/java/org/opensearch/security/support/Base64Helper.java
index 6b1b79be9b..858e40395d 100644
--- a/src/main/java/org/opensearch/security/support/Base64Helper.java
+++ b/src/main/java/org/opensearch/security/support/Base64Helper.java
@@ -31,6 +31,7 @@
 import java.io.IOException;
 import java.io.InputStream;
 import java.io.InvalidClassException;
+import java.io.ObjectInputFilter;
 import java.io.ObjectInputStream;
 import java.io.ObjectOutputStream;
 import java.io.ObjectStreamClass;
@@ -103,6 +104,7 @@ public static Serializable deserializeObject(final String string) {
     private final static class SafeObjectInputStream extends ObjectInputStream {
         public SafeObjectInputStream(InputStream in) throws IOException {
             super(in);
+            setObjectInputFilter(ObjectInputFilter.Config.createFilter("maxdepth=10"));
         }
 
         @Override
diff --git a/src/main/java/org/opensearch/security/support/SafeSerializationUtils.java b/src/main/java/org/opensearch/security/support/SafeSerializationUtils.java
index be4bbc05c6..f75c778443 100644
--- a/src/main/java/org/opensearch/security/support/SafeSerializationUtils.java
+++ b/src/main/java/org/opensearch/security/support/SafeSerializationUtils.java
@@ -21,7 +21,6 @@
 import java.util.concurrent.ConcurrentHashMap;
 import java.util.regex.Pattern;
 
-import com.google.common.collect.ImmutableMap;
 import com.google.common.collect.ImmutableSet;
 
 import com.amazon.dlic.auth.ldap.LdapUser;
@@ -58,15 +57,10 @@ public final class SafeSerializationUtils {
         Number.class,
         Collection.class,
         Map.class,
-        Enum.class,
-        ImmutableMap.class
+        Enum.class
     );
 
-    private static final Set<String> SAFE_CLASS_NAMES = Set.of(
-        "org.ldaptive.LdapAttribute$LdapAttributeValues",
-        "com.google.common.collect.ImmutableBiMap$SerializedForm",
-        "com.google.common.collect.ImmutableMap$SerializedForm"
-    );
+    private static final Set<String> SAFE_CLASS_NAMES = Set.of("org.ldaptive.LdapAttribute$LdapAttributeValues");
     static final Map<Class<?>, Boolean> safeClassCache = new ConcurrentHashMap<>();
 
     static boolean isSafeClass(Class<?> cls) {