Fix code review issues: improve test assertions and add clarifying comments

Co-authored-by: tvaron3 <70857381+tvaron3@users.noreply.github.com>

Author: Copilot

sdk/cosmos/azure-cosmos-tests/src/test/java/com/azure/cosmos/SerializableDocumentCollectionTests.java

@@ -81,7 +81,7 @@ public void deserializeWithInvalidClassType_shouldFail() throws Exception {
             SerializableDocumentCollection deserializedDocumentCollection = (SerializableDocumentCollection) ois.readObject();
 
             // Should not reach here
-            assertThat(false).as("Expected InvalidClassException to be thrown").isTrue();
+            org.testng.Assert.fail("Expected InvalidClassException to be thrown");
         } catch (java.io.InvalidClassException e) {
             // Expected - the malicious class type was rejected
             assertThat(e.getMessage()).contains("Expected ObjectNode");

sdk/cosmos/azure-cosmos-tests/src/test/java/com/azure/cosmos/implementation/caches/SerializableAsyncCacheTest.java

@@ -144,7 +144,7 @@ public void deserializeWithInvalidClassType_shouldFail() throws Exception {
             SerializableAsyncCollectionCache cache = (SerializableAsyncCollectionCache) ois.readObject();
 
             // Should not reach here
-            assertThat(false).as("Expected InvalidClassException to be thrown").isTrue();
+            org.testng.Assert.fail("Expected InvalidClassException to be thrown");
         } catch (java.io.InvalidClassException e) {
             // Expected - the malicious class type was rejected
             assertThat(e.getMessage()).contains("Expected SerializableDocumentCollection");
@@ -172,7 +172,7 @@ public void safeObjectInputStream_rejectsUnauthorizedClasses() throws Exception
             AsyncCache<String, DocumentCollection> cache = snapshot.getCollectionInfoByNameCache();
 
             // Should not reach here
-            assertThat(false).as("Expected exception to be thrown for unauthorized class").isTrue();
+            org.testng.Assert.fail("Expected exception to be thrown for unauthorized class");
         } catch (Exception e) {
             // Expected - the unauthorized class was rejected
             // The exception could be wrapped in a CosmosException, so check the cause chain

sdk/cosmos/azure-cosmos/src/main/java/com/azure/cosmos/implementation/caches/AsyncCache.java

@@ -253,7 +253,7 @@ private void readObject(ObjectInputStream ois) throws ClassNotFoundException, IO
             // 1. All existing production code uses the default equality comparer
             // 2. The serialization format remains unchanged (we still write the comparer for backward compatibility)
             // 3. Future format changes should increment the serialVersionUID to handle compatibility explicitly
-            ois.readObject(); // Read and discard the serialized comparer to maintain format compatibility
+            Object unusedComparer = ois.readObject(); // Read and discard the serialized comparer to maintain format compatibility
 
             // Use the default equality comparer (same as AsyncCache constructor)
             @SuppressWarnings("unchecked")

sdk/cosmos/azure-cosmos/src/main/java/com/azure/cosmos/implementation/caches/SafeObjectInputStream.java

@@ -17,6 +17,13 @@
 /**
  * A secure ObjectInputStream that restricts deserialization to a whitelist of allowed classes.
  * This prevents Remote Code Execution (RCE) attacks via unsafe deserialization.
+ * 
+ * <p>Note: This class only validates the top-level class being deserialized from the stream.
+ * Nested objects deserialized within a class's {@code readObject()} method are not checked
+ * by this class - they must be validated by the class's own deserialization logic.
+ * For example, when deserializing a {@code SerializableAsyncCollectionCache}, this class
+ * validates the outer cache object, while the cache's {@code readObject()} method is
+ * responsible for validating the individual collection objects it deserializes.</p>
  */
 public class SafeObjectInputStream extends ObjectInputStream {
     private static final Logger LOGGER = LoggerFactory.getLogger(SafeObjectInputStream.class);