Harden registration event serialization for CVE-2017-2603.

Mark the dedicated User field in OnRegistrationCompleteEvent as transient and add a serialization test, while keeping default test-skip behavior unchanged but overridable for validation evidence.

Made-with: Cursor

source/xzs/pom.xml

@@ -20,6 +20,8 @@
         <java.version>1.8</java.version>
         <mysql.version>8.0.17</mysql.version>
         <spring.boot.version>2.1.6.RELEASE</spring.boot.version>
+        <!-- Preserve previous default: unit tests off unless -Dskip.unit.tests=false -->
+        <skip.unit.tests>true</skip.unit.tests>
     </properties>
 
 
@@ -181,7 +183,7 @@
                 <groupId>org.apache.maven.plugins</groupId>
                 <artifactId>maven-surefire-plugin</artifactId>
                 <configuration>
-                    <skipTests>true</skipTests>
+                    <skipTests>${skip.unit.tests}</skipTests>
                 </configuration>
             </plugin>
         </plugins>

source/xzs/src/main/java/com/mindskip/xzs/event/OnRegistrationCompleteEvent.java

@@ -12,7 +12,10 @@ import org.springframework.context.ApplicationEvent;
 public class OnRegistrationCompleteEvent extends ApplicationEvent {
 
 
-    private final User user;
+    /**
+     * Avoid serializing full user details when this event is persisted.
+     */
+    private final transient User user;
 
 
     /**

source/xzs/src/test/java/com/mindskip/xzs/event/OnRegistrationCompleteEventSerializationTest.java

@@ -0,0 +1,38 @@
+package com.mindskip.xzs.event;
+
+import com.mindskip.xzs.domain.User;
+import org.junit.Test;
+
+import java.io.ByteArrayInputStream;
+import java.io.ByteArrayOutputStream;
+import java.io.ObjectInputStream;
+import java.io.ObjectOutputStream;
+
+import static org.junit.Assert.assertNull;
+
+public class OnRegistrationCompleteEventSerializationTest {
+
+    @Test
+    public void dedicatedUserFieldIsNotSerialized() throws Exception {
+        User user = new User();
+        user.setId(1);
+        user.setUserName("alice");
+        user.setPassword("secret-password");
+
+        OnRegistrationCompleteEvent event = new OnRegistrationCompleteEvent(user);
+
+        byte[] bytes;
+        try (ByteArrayOutputStream baos = new ByteArrayOutputStream();
+                ObjectOutputStream oos = new ObjectOutputStream(baos)) {
+            oos.writeObject(event);
+            bytes = baos.toByteArray();
+        }
+
+        OnRegistrationCompleteEvent deserialized;
+        try (ObjectInputStream ois = new ObjectInputStream(new ByteArrayInputStream(bytes))) {
+            deserialized = (OnRegistrationCompleteEvent) ois.readObject();
+        }
+
+        assertNull("transient user field should not survive serialization", deserialized.getUser());
+    }
+}