fix: harden complex parameter model loading

[Rana Singh (ranadeepsingh)]

Related Issues/PRs

Follow-up to #2513 and the remaining MSRC recommendation in IcM 31000000568481.

What changes are proposed in this pull request?

This PR closes the remaining unrestricted Java deserialization path in
ComplexParams model persistence. A crafted artifact could previously execute
deserialization callbacks before the eventual type cast.

The patch:

• fails closed for unconstrained Java object graphs and permits only audited,
  type-specific class policies;
• rejects serialized lambdas and unsafe proxies and enforces graph, object,
  array, string, stream, metadata, path, and heap-aware limits;
• migrates data types and nested stages to bounded formats/readers where
  possible;
• validates model metadata, canonical artifact containment, aliases, links,
  and bounded remote enumeration before reader construction;
• scopes trusted legacy compatibility to the active Spark session and explicit
  artifact load;
• binds SynapseML Python readers to the active session and uses the bounded
  PipelineSerializer for generated nested-stage tests; and
• centralizes trust for harness-created fixtures instead of adding
  suite-specific opt-outs.

Compatibility contract

New data-only parameter artifacts load without unsafe Java deserialization.
Legacy artifacts containing arbitrary closures, BallTrees, DataFrames, native
readers, or native Spark Pipeline nesting must be explicitly treated as
trusted by setting
spark.synapseml.legacy.allowUnsafeJavaDeserialization=true on the reader's
Spark session. Native Pipeline compatibility must additionally run inside
Serializer.withTrustedArtifactLoad; untrusted nested models use SynapseML's
bounded PipelineSerializer.

Direct ConditionalBallTree.load fails closed. Trusted legacy callers can use
the explicit loadUnsafe API.

Scope

The effective diff contains 20 connected production security-boundary files
and 25 focused test/harness files. It contains no review artifacts, dependency
changes, workflow changes, or generated target/ files.

How is this patch tested?

• Master baseline (JDK 11 / Scala 2.12): affected module main/test
  compilation and Scalastyle.
• Core exploit, resource-budget, metadata/path, session-isolation,
  Pipeline/ComplexParams, generated-loader, UDF, recommendation, and
  persistence suites.
• LightGBM constrained-deserialization test on Scala 2.12.
• Generated persistence runtime tests: core (2), cognitive (1), and deep
  learning (3), including trust cleanup assertions.
• Core, cognitive, deep-learning, and OpenCV code/test generation plus
  generated Python syntax compilation.
• Black 22.3.0 and git diff --check.
• Exact Azure failure reproductions: 59 focused tests on both the master and
  Spark 4.1 baselines, Spark ML-compatible generated R metadata paths, and the
  session-scoped SAR trusted round trip with trust restoration.
• Spark 4.1 replay (JDK 17 / Scala 2.13): all affected module test
  compilation, 86 focused core tests, and the LightGBM constrained
  deserialization test.

Does this PR change any dependencies?

• No. You can skip this section.
• Yes. Make sure the dependencies are resolved correctly, and list changes here.

Does this PR add a new feature? If so, have you added samples on website?

• No. You can skip this section.
• Yes. Make sure you have added samples following below steps.

[azure-pipelines]

Azure Pipelines:
There may be pipelines that require an authorized user to comment /azp run to run.

[github-actions]

Hey Rana Singh (@ranadeepsingh) 👋!
Thank you so much for contributing to our repository 🙌.
Someone from SynapseML Team will be reviewing this pull request soon.

We use semantic commit messages to streamline the release process.
Before your pull request can be merged, you should make sure your first commit and PR title start with a semantic prefix.
This helps us to create release messages and credit you for your hard work!

Examples of commit messages with semantic prefixes:

• fix: Fix LightGBM crashes with empty partitions
• feat: Make HTTP on Spark back-offs configurable
• docs: Update Spark Serving usage
• build: Add codecov support
• perf: improve LightGBM memory usage
• refactor: make python code generation rely on classes
• style: Remove nulls from CNTKModel
• test: Add test coverage for CNTKModel

To test your commit locally, please follow our guild on building from source.
Check out the developer guide for additional guidance on testing your change.

[Rana Singh (ranadeepsingh)]

/azp run

[azure-pipelines]

Azure Pipelines:
Successfully started running 1 pipeline(s).

[Copilot]

Pull request overview

This PR hardens SynapseML/SparkML model persistence and loading paths to fail closed against unsafe Java deserialization, unbounded metadata/object graphs, and path-traversal/link/glob issues—while preserving an explicit trusted-legacy compatibility switch for artifacts that cannot be safely constrained.

Changes:

• Introduces a session-scoped “trusted legacy artifact” gate (spark.synapseml.legacy.allowUnsafeJavaDeserialization) and routes unsafe persistence (UDF closures, custom readers, BallTrees, DataFrames, etc.) behind explicit opt-in.
• Adds hardened, budgeted model metadata/path handling (canonical containment, link resolution, bounded metadata enumeration and decoding budgets, recursive model context) for Pipeline/ComplexParams loads.
• Migrates DataTypeParam persistence toward bounded JSON handling and adds/updates extensive regression coverage for security and compatibility.

Show a summary per file

File	Description
reviews/serializer-deserialization/task-2513-attempt-1-review-1-gpt-5.6-sol.md	Adds a long-form review artifact documenting the hardening work and verification steps.
lightgbm/src/test/scala/com/microsoft/azure/synapse/ml/lightgbm/params/VerifyLightGBMBoosterParam.scala	Adds a regression ensuring LightGBM booster param loads under constrained legacy handling.
lightgbm/src/main/scala/com/microsoft/azure/synapse/ml/lightgbm/params/LightGBMBoosterParam.scala	Adds a narrow deserialization class policy for LightGBMBoosterParam.
core/src/test/scala/org/apache/spark/ml/VerifyArtifactPathResolver.scala	Adds tests for metadata listing guarantees and Java 8 linkage constraints.
core/src/test/scala/com/microsoft/azure/synapse/ml/stages/UDFTransformerSuite.scala	Adds trust-gating tests for persisted UDFs and session propagation through PipelineSerializer.
core/src/test/scala/com/microsoft/azure/synapse/ml/stages/LambdaSuite.scala	Enables trusted legacy load path for serialization fuzzing where needed.
core/src/test/scala/com/microsoft/azure/synapse/ml/recommendation/RankingTrainValidationSpec.scala	Enables trusted legacy load path for serialization fuzzing in ranking suites.
core/src/test/scala/com/microsoft/azure/synapse/ml/param/VerifyEvaluatorParam.scala	Adds explicit-trust tests for evaluator param persistence.
core/src/test/scala/com/microsoft/azure/synapse/ml/param/VerifyEstimatorArrayParam.scala	Adds coverage for stage-array persistence (safe writable vs trusted legacy cases).
core/src/test/scala/com/microsoft/azure/synapse/ml/param/VerifyDataTypeParam.scala	Adds coverage for JSON DataType persistence and legacy-stream gating/tripwires.
core/src/test/scala/com/microsoft/azure/synapse/ml/param/VerifyDataFrameParam.scala	Adds regression guarding against linked Parquet parts escaping artifact containment.
core/src/test/scala/com/microsoft/azure/synapse/ml/param/VerifyArrayParamMapParam.scala	Adds explicit-trust coverage for ArrayParamMapParam persistence.
core/src/test/scala/com/microsoft/azure/synapse/ml/nn/VerifySchemas.scala	Extends SafeObjectInputStream/BallTree coverage and validates fail-closed NN loading defaults.
core/src/test/scala/com/microsoft/azure/synapse/ml/io/split1/ParserSuite.scala	Enables trusted legacy load path for serialization fuzzing in parser suites where applicable.
core/src/test/scala/com/microsoft/azure/synapse/ml/core/utils/VerifySafeObjectInputStream.scala	Adds focused unit tests for SafeObjectInputStream resource and policy enforcement.
core/src/test/scala/com/microsoft/azure/synapse/ml/core/test/fuzzing/Fuzzing.scala	Adds a controlled trusted-legacy mode for serialization fuzzing and Pipeline/PipelineModel round trips.
core/src/test/scala/com/microsoft/azure/synapse/ml/core/serialize/VerifyModelLoadEnvironment.scala	Adds environment regressions around session scoping, trusted loading, and provider behaviors.
core/src/test/scala/com/microsoft/azure/synapse/ml/core/serialize/VerifyMetadataBudgets.scala	Adds regression ensuring aggregate decoded-metadata budgets are enforced.
core/src/test/scala/com/microsoft/azure/synapse/ml/core/serialize/ValidateComplexParamSerializer.scala	Significantly expands hardening regressions across metadata, paths, trust gates, and reader safety.
core/src/test/scala/com/microsoft/azure/synapse/ml/automl/VerifyFindBestModel.scala	Enables trusted legacy load path for serialization fuzzing in AutoML persistence tests.
core/src/main/scala/org/apache/spark/ml/StageReaderInspector.scala	Adds bytecode-based reader classification without class initialization.
core/src/main/scala/org/apache/spark/ml/Serializer.scala	Centralizes hardened serializer routing, trust scoping, Pipeline serializers, and safe read/write behavior.
core/src/main/scala/org/apache/spark/ml/ModelLoadContext.scala	Introduces shared load/write budgets (nodes, depth, metadata physical/decoded) across nested model loads.
core/src/main/scala/org/apache/spark/ml/DataTypeSerializer.scala	Implements bounded DataType JSON persistence with legacy-stream detection and UDT gating.
core/src/main/scala/org/apache/spark/ml/ComplexParamsSerializer.scala	Hardens ComplexParams read/write (session assignment, budgets, metadata accounting, and native pipeline boundaries).
core/src/main/scala/org/apache/spark/ml/ArtifactPathResolver.scala	Adds canonical containment, link resolution, bounded metadata enumeration/decoding, and safe directory validation helpers.
core/src/main/scala/com/microsoft/azure/synapse/ml/param/TransformerArrayParam.scala	Persists transformer arrays via hardened PipelineArraySerializer and validates load-time types.
core/src/main/scala/com/microsoft/azure/synapse/ml/param/EstimatorArrayParam.scala	Persists estimator arrays via hardened PipelineArraySerializer and validates load-time types.
core/src/main/scala/com/microsoft/azure/synapse/ml/param/DataTypeParam.scala	Adjusts DataTypeParam imports to align with new DataTypeSerializer path.
core/src/main/scala/com/microsoft/azure/synapse/ml/param/DataFrameParam.scala	Marks DataFrameParam as not supporting untrusted deserialization by default.
core/src/main/scala/com/microsoft/azure/synapse/ml/param/ByteArrayParam.scala	Adds an explicit deserialization class policy (primitive byte arrays).
core/src/main/scala/com/microsoft/azure/synapse/ml/param/BallTreeParam.scala	Marks BallTree params as requiring trusted loading (fail closed by default).
core/src/main/scala/com/microsoft/azure/synapse/ml/nn/BallTree.scala	Changes ConditionalBallTree default load to fail closed and adds explicit loadUnsafe.
core/src/main/scala/com/microsoft/azure/synapse/ml/core/utils/SafeObjectInputStream.scala	Expands SafeObjectInputStream with resource limits, filter composition, and class allowlisting model.
core/src/main/scala/com/microsoft/azure/synapse/ml/core/serialize/ComplexParam.scala	Adds per-param deserialization policy hooks and trust gating for unsafe complex params.

Review details

💡 Configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

• Files reviewed: 34/35 changed files
• Comments generated: 2
• Review effort level: Lite

[Rana Singh (ranadeepsingh)]

/azp run

[azure-pipelines]

Azure Pipelines:
Successfully started running 1 pipeline(s).

[Copilot]

Review details

• Files reviewed: 35/35 changed files
• Comments generated: 3
• Review effort level: Lite

[Rana Singh (ranadeepsingh)]

/azp run

[azure-pipelines]

Azure Pipelines:
Successfully started running 1 pipeline(s).

[Copilot]

Review details

Suppressed comments (2)

Previously missed (2) — in code that hasn't changed since the last review.

core/src/main/scala/org/apache/spark/ml/Serializer.scala:88

• typeToSerializer routes any Array[_] whose element type is a subtype of PipelineStage to PipelineArraySerializer and then casts it to Serializer[T]. Since arrays are reified on the JVM, PipelineArraySerializer will return an Array[PipelineStage], which cannot be safely treated as (for example) Array[Estimator[_]]/Array[Transformer] and can produce ClassCastException for any caller that goes through Serializer.typeToSerializer (outside the specialized Param overrides).

Consider returning a small adapter serializer for pipeline-stage arrays that converts to/from Array[PipelineStage] while preserving the requested runtime component type.

  def typeToSerializer[T](
      tpe: Type,
      sparkSession: SparkSession,
      classFilter: Option[DeserializationClassFilter]): Serializer[T] = {
    (if (tpe <:< typeOf[PipelineStage])              new PipelineSerializer(sparkSession)
     else if (isPipelineStageArray(tpe))             new PipelineArraySerializer(sparkSession)

core/src/main/scala/com/microsoft/azure/synapse/ml/core/utils/SafeObjectInputStream.scala:218

• SafeObjectInputStream.ResourceFilter is a shared singleton instance of DeserializationResourceFilter, but DeserializationResourceFilter is stateful (declaredArrayBytes accumulates across checkInput calls). This makes the exposed filter instance easy to misuse and can make future tests order-dependent if they call ResourceFilter.checkInput on multiple “allowed” inputs.

Prefer exposing a factory (e.g., def newResourceFilter(...)) that returns a fresh per-stream filter, and update VerifySafeObjectInputStream to construct a new instance for assertions.

  private[utils] val ResourceFilter: ObjectInputFilter =
    new DeserializationResourceFilter(defaultResourceLimits)

• Files reviewed: 35/35 changed files
• Comments generated: 0 new
• Review effort level: Lite

[Rana Singh (ranadeepsingh)]

Resolved both suppressed findings from the 9aa866acbd automated review in 0e360a5827:

• Generic PipelineStage-array serializers now allocate and validate the requested reified component type, with direct Array[Estimator[_]] and Array[Transformer] round-trip coverage.
• DeserializationResourceFilter is now created fresh per stream/test instead of exposing a shared stateful singleton.
• The same commit fully qualifies Spark Transformer, and the complete patch now passes spark4.1 core/Test/compile locally under Java 17 / Scala 2.13.

Master core compilation, main/test Scalastyle, VerifyEstimatorArrayParam, VerifySafeObjectInputStream, and ValidateComplexParamSerializer all pass.

[Rana Singh (ranadeepsingh)]

/azp run

[azure-pipelines]

Azure Pipelines:
Successfully started running 1 pipeline(s).

[Copilot]

Review details

• Files reviewed: 36/36 changed files
• Comments generated: 1
• Review effort level: Lite

[Rana Singh (ranadeepsingh)]

/azp run

[azure-pipelines]

Azure Pipelines:
Successfully started running 1 pipeline(s).

[Rana Singh (ranadeepsingh)]

Resolved the exact-head Azure Publish failure from build 232908468 in 0036b77c5b.

The job used Temurin 8 and failed before publishing because java.io.ObjectInputFilter is a Java 9+ API. The fix isolates JEP 290 API differences behind a fail-closed runtime adapter: Java 9+ uses java.io.ObjectInputFilter, Java 8 uses the sun.misc.ObjectInputFilter backport, and runtimes without either abort before object-graph loading.

Current-head evidence:

• Temurin 8u504: core/compile, core/Test/compile, and all 8 VerifySafeObjectInputStream tests pass, including a real JEP 290 rejection.
• JDK 11 / Spark 3.5: core main/test compile, main/test Scalastyle, 37 end-to-end deserialization tests pass.
• JDK 17 / Scala 2.13 / spark4.1 replay: core/Test/compile and all 8 filter tests pass.
• No compile-time ObjectInputFilter reference remains; only runtime class-name strings are used.

[Rana Singh (ranadeepsingh)]

/azp run

[azure-pipelines]

Azure Pipelines:
Successfully started running 1 pipeline(s).

[Copilot]

Review details

Suppressed comments (1)

Previously missed (1) — in code that hasn't changed since the last review.

core/src/test/scala/org/apache/spark/ml/VerifyArtifactPathResolver.scala:79

• The InputStream is closed only on the happy path. If an assertion fails or an exception occurs during the read loop, the stream will leak and can hold open jar/file handles. Wrap the body in try/finally so input.close() always runs.

• Files reviewed: 37/37 changed files
• Comments generated: 0 new
• Review effort level: Lite

[Rana Singh (ranadeepsingh)]

Resolved the suppressed 0036b77c5b review finding in f108242bd0: the Java 8 class-linkage test now scopes its resource stream with StreamUtilities.using, so read or assertion failures cannot leak file/jar handles.

VerifyArtifactPathResolver (6 tests), test compilation, and test Scalastyle pass on both Spark 3.5/JDK 11 and the spark4.1/Scala 2.13/JDK 17 replay.

[Rana Singh (ranadeepsingh)]

/azp run

[azure-pipelines]

Azure Pipelines:
Successfully started running 1 pipeline(s).

[Copilot]

Review details

• Files reviewed: 37/37 changed files
• Comments generated: 0 new
• Review effort level: Lite

[Rana Singh (ranadeepsingh)]

/azp run

[azure-pipelines]

Azure Pipelines:
Successfully started running 1 pipeline(s).

[Copilot]

Review details

• Files reviewed: 43/43 changed files
• Comments generated: 0 new
• Review effort level: Lite

[Rana Singh (ranadeepsingh)]

Resolved the exact-head Azure failures from build 233002476 in 026e043efa without adding suite-wide bypasses:

• UnitTests misc: updated the stale ModelParam.pyLoadLine assertion to the bounded PipelineSerializer + JavaParams._from_java contract.
• RTests core / RTests deep-learning: bounded ComplexParams metadata now retains Spark ML's metadata/part-00000 and _SUCCESS layout required by sparklyr. Representative fixtures at all Azure-reported nesting shapes regenerate with that exact path.
• PythonTests core: the handwritten SAR lazy-DataFrame persistence test now uses the documented session-scoped trusted load and restores the prior Spark setting; production remains fail-closed.

Current-head evidence:

• JDK 11 / Spark 3.5: 59 focused serializer, metadata, and generated-code tests pass; core main/test Scalastyle passes.
• JDK 17 / Spark 4.1 / Scala 2.13: the same 59 focused tests pass; core test Scalastyle passes.
• Generated core and deep-learning R fixtures contain the exact metadata paths missing in Azure.
• The SAR trusted round trip passes against the freshly built jar and confirms trust is unset after load.
• Black 22.3.0 and git diff --check pass.

[Rana Singh (ranadeepsingh)]

/azp run

[azure-pipelines]

Azure Pipelines:
Successfully started running 1 pipeline(s).

[Copilot]

Review details

• Files reviewed: 45/45 changed files
• Comments generated: 0 new
• Review effort level: Lite