AEM - after upgrade to JDK11 I can no longer pass class parameter to the scheduled job

Question

After upgrade to JDK11 I'm no longer able to run some of my AEM 6.5 Sling jobs. It seems there is some problem with visibility of class that is used to pass parameters to the job.

Here is how the job is prepared and scheduled:

    final Map<String, Object> props = new HashMap<String, Object>();
    props.put("stringParam", "something");
    props.put("classParam", new Dto());
    Job job = jobManager.addJob("my/special/jobtopic", props);

The jobs is not started, as it seems there is any problem during job start, during parameters setup. The stringParam is ok, but classParam usage throws following exception:

28.01.2022 17:28:25.978 *WARN* [sling-oak-observation-17]     org.apache.sling.event.impl.jobs.queues.QueueJobCache
Unable to read job from /var/eventing/jobs/assigned/.../my.package.myJob/2022/1/27/15/50/...

java.lang.Exception: Unable to deserialize property 'classParam'
    at org.apache.sling.event.impl.support.ResourceHelper.cloneValueMap(ResourceHelper.java:218)
    at org.apache.sling.event.impl.jobs.Utility.readJob(Utility.java:181)
...
Caused by: java.lang.ClassNotFoundException: my.package.Dto
    at java.base/java.net.URLClassLoader.findClass(URLClassLoader.java:471)
    at java.base/java.lang.ClassLoader.loadClass(ClassLoader.java:588)
    at org.apache.sling.launchpad.base.shared.LauncherClassLoader.loadClass(LauncherClassLoader.java:160)
    at java.base/java.lang.ClassLoader.loadClass(ClassLoader.java:521)
    at org.apache.felix.framework.BundleWiringImpl.doImplicitBootDelegation(BundleWiringImpl.java:1817)

I'm pretty sure that the Dto class is visible and exported from my OSGI bundle, it can be used and consumed from another bundles. But for some reason internal sling logic is unable to resolve it. How can I make my Dto class accessible to internal Sling logic?

Any idea why does this happen and how to solve it?

Answer 1

The java.lang.ClassNotFoundException exception is misleading in this case. The true reason for this problem is " Java Serialization Filter " that was added in JDK 9. It affects object deserialization rules.

I tried to do parameter serialization / deserialization myself and pass serialized object in base64 string:

String serializedString = job.getProperty("dto", String.class);
byte [] serializedBytes = Base64.getDecoder().decode(serializedString);
ByteArrayInputStream bais = new ByteArrayInputStream(serializedBytes);
ObjectInputStream ois = new ObjectInputStream(bais);
dtoParam = (Dto)ois.readObject();

Job was scheduled and run, however the result was java.io.InvalidClassException: filter status: REJECTED It helped to find the true cause:

AEM implementation uses internal deserialization filter com.adobe.cq.deserfw.impl.FirewallSerialFilter that could be configured in OSGI Felix console. The component name is com.adobe.cq.deserfw.impl.DeserializationFirewallImpl.name .

Here add your class or package name.