Merge branch '7.0.x'

spring-core/src/main/java/org/springframework/core/serializer/DefaultDeserializer.java

@@ -59,6 +59,17 @@ public class DefaultDeserializer implements Deserializer<Object> {
 	}
 
 
+	/**
+	 * Return the {@link ClassLoader} to use for deserialization, or {@code null}
+	 * to use the "latest user-defined ClassLoader".
+	 * @since 6.2.19
+	 * @see ConfigurableObjectInputStream#ConfigurableObjectInputStream(InputStream, ClassLoader)
+	 */
+	public @Nullable ClassLoader getClassLoader() {
+		return this.classLoader;
+	}
+
+
 	/**
 	 * Read from the supplied {@code InputStream} and deserialize the contents
 	 * into an object.

spring-core/src/test/java/org/springframework/core/serializer/SerializerTests.java

@@ -78,6 +78,17 @@ class SerializerTests {
 		assertThat(deserializer.expectedInputStream).isNotNull();
 	}
 
+	@Test  // gh-36833
+	void defaultDeserializerExposesNullClassLoaderByDefault() {
+		assertThat(new DefaultDeserializer().getClassLoader()).isNull();
+	}
+
+	@Test  // gh-36833
+	void defaultDeserializerExposesConfiguredClassLoader() {
+		ClassLoader classLoader = getClass().getClassLoader();
+		assertThat(new DefaultDeserializer(classLoader).getClassLoader()).isSameAs(classLoader);
+	}
+
 	@Test
 	void serializationDelegateWithExplicitSerializerAndDeserializer() throws IOException {
 		SerializationDelegate delegate = new SerializationDelegate(new DefaultSerializer(), new DefaultDeserializer());