Expose ClassLoader from DefaultDeserializer

Add a public accessor for the ClassLoader configured on a
DefaultDeserializer instance so that callers no longer need to read the
private field via reflection in order to forward it to a
ConfigurableObjectInputStream subclass.

See gh-36827
Closes gh-36833

Signed-off-by: seonwoo_jung <laborlawseon@kap.kr>
(cherry picked from commit f7be796c1c)

spring-core/src/main/java/org/springframework/core/serializer/DefaultDeserializer.java

@@ -59,6 +59,18 @@ public class DefaultDeserializer implements Deserializer<Object> {
 	}
 
 
+	/**
+	 * Return the {@link ClassLoader} to use for deserialization, or {@code null}
+	 * to use the "latest user-defined ClassLoader" of {@link ObjectInputStream}.
+	 * @since 7.1
+	 * @see ConfigurableObjectInputStream#ConfigurableObjectInputStream(InputStream, ClassLoader)
+	 */
+	@Nullable
+	public ClassLoader getClassLoader() {
+		return this.classLoader;
+	}
+
+
 	/**
 	 * Read from the supplied {@code InputStream} and deserialize the contents
 	 * into an object.

spring-core/src/test/java/org/springframework/core/serializer/SerializerTests.java

@@ -78,6 +78,17 @@ class SerializerTests {
 		assertThat(deserializer.expectedInputStream).isNotNull();
 	}
 
+	@Test
+	void defaultDeserializerExposesNullClassLoaderByDefault() {
+		assertThat(new DefaultDeserializer().getClassLoader()).isNull();
+	}
+
+	@Test
+	void defaultDeserializerExposesConfiguredClassLoader() {
+		ClassLoader classLoader = getClass().getClassLoader();
+		assertThat(new DefaultDeserializer(classLoader).getClassLoader()).isSameAs(classLoader);
+	}
+
 	@Test
 	void serializationDelegateWithExplicitSerializerAndDeserializer() throws IOException {
 		SerializationDelegate delegate = new SerializationDelegate(new DefaultSerializer(), new DefaultDeserializer());