[Proposal] Allow users to specify trusted Avro serializable classes to Dataflow worker

Author: clairemcginty

runners/google-cloud-dataflow-java/src/main/java/org/apache/beam/runners/dataflow/options/DataflowPipelineOptions.java

@@ -266,4 +266,14 @@ public String create(PipelineOptions options) {
   List<String> getJdkAddOpenModules();
 
   void setJdkAddOpenModules(List<String> options);
+
+  /**
+   * Set trusted serializable classes for use with the Avro `java-class` schema property.
+   *
+   * <p>See: https://github.com/apache/avro/pull/3376
+   */
+  @Description("Serializable classes required by java-class props in Avro 1.11.4+")
+  List<String> getAvroSerializableClasses();
+
+  void setAvroSerializableClasses(List<String> options);
 }

sdks/java/container/boot.go

@@ -276,6 +276,10 @@ func main() {
 				args = append(args, "--add-modules="+module.GetStringValue())
 			}
 		}
+		// Add trusted Avro serializable classes
+		if serializableClasses, ok := pipelineOptions.GetStructValue().GetFields()["avroSerializableClasses"]; ok {
+			args = append(args, "-Dorg.apache.avro.SERIALIZABLE_CLASSES="+strings.Join(serializableClasses.GetStringValue(), ",")
+		}
 	}
 	// Automatically open modules for Java 11+
 	openModuleAgentJar := "/opt/apache/beam/jars/open-module-agent.jar"