Make allowed_deserialization_classes more intuitive

airflow/config_templates/config.yml

@@ -225,7 +225,7 @@ core:
       description: |
         What classes can be imported during deserialization. This is a multi line value.
         The individual items will be parsed as regexp. Python built-in classes (like dict)
-        are always allowed
+        are always allowed. Bare "." will be replaced so you can set airflow.* .
       version_added: 2.5.0
       type: string
       default: 'airflow\..*'

airflow/config_templates/default_airflow.cfg

@@ -137,7 +137,7 @@ enable_xcom_pickling = False
 
 # What classes can be imported during deserialization. This is a multi line value.
 # The individual items will be parsed as regexp. Python built-in classes (like dict)
-# are always allowed
+# are always allowed. Bare "." will be replaced so you can set airflow.* .
 allowed_deserialization_classes = airflow\..*
 
 # When a task is killed forcefully, this is the amount of time in seconds that

airflow/serialization/serde.py

@@ -299,6 +299,7 @@ def _compile_patterns():
 
     _patterns.clear()  # ensure to reinit
     for p in patterns:
+        p = re.sub(r"(\w)\.", r"\1\..", p)
         _patterns.append(re.compile(p))
 
 

tests/serialization/test_serde.py

@@ -31,6 +31,7 @@
     SCHEMA_ID,
     VERSION,
     _compile_patterns,
+    _match,
     deserialize,
     serialize,
 )
@@ -181,6 +182,16 @@ def test_allow_list_for_imports(self):
 
         assert f"{qualname(Z)} was not found in allow list" in str(ex.value)
 
+    @conf_vars(
+        {
+            ("core", "allowed_deserialization_classes"): "tests.*",
+        }
+    )
+    def test_allow_list_replace(self):
+        _compile_patterns()
+        assert _match("tests.airflow.deep")
+        assert _match("testsfault") is False
+
     def test_incompatible_version(self):
         data = dict(
             {