alibaba / alibaba/fastjson2

[BUG]fastjson2 2.0.28一直到最新版本特定情况下反序列化字段读取值错误

Open
#3,146 3 comments 0 reactions 0 assignees View on GitHub
bug
Dominant language
Java
Stars
4.4k
Forks
613
Avg merge
1d 22h
Merged PRs (30d)
6

Description

### 问题描述
fastjson2 2.0.28一直到最新版本,在对json字符串反序列化的时候,如果有字段为字符串"1",并且在反序列化之前对相应字符串做过以下操作时,
![image](https://github.com/user-attachments/assets/0c53fe4c-491b-4760-af48-1464b7cb82b1)
然后再序列化时读取不到值
### 环境信息
- OS信息: [e.g.:CentOS 7、win10等系统]
- JDK信息: [e.g.:Openjdk 1.8.0_312]
- 版本信息:[e.g.:Fastjson2 2..0.28]

### 重现步骤

1. 使用 下面代码测试,目前测试只有字符串"1"会出现问题,2.0.27和之前的版本解析没问题,错误如图:
![image](https://github.com/user-attachments/assets/59db9ed8-3df4-43f8-b197-e66d8df442a9)
读取不到所有值为“1”的字段了
【测试代码】
```java
public class TestFastJson {
public static void main(String[] args) {
User user = new User();
user.setId("test1");
user.setName("1");
user.setPassword("1");
String str1 = JSONObject.toJSONString(user);
JSONObject jsonObject = JSONObject.parseObject(str1);
// 模拟清理内存中的密码
clearPassword(jsonObject.getString("password"));
JSONObject jsonObject2 = JSONObject.parseObject(str1);
}

private static void clearPassword(String pw) {
try {
Field field = String.class.getDeclaredField("value");
field.setAccessible(true);
char[] value = (char[]) field.get(pw);
Arrays.fill(value,'\u0000');
} catch (NoSuchFieldException e) {
e.printStackTrace();
} catch (IllegalAccessException e) {
e.printStackTrace();
}
}
}
```

### 期待的正确结果
希望能够正常反序列化,业务代码经常会有清除内存敏感数据的场景,不确定是否还有别的问题,希望能够解答问题的具体原因,十分感谢

Contributor guide

Open the contributing guide

Research direction

Start by running the supplied Java reproducer against fastjson2 2.0.27 and the latest version, focusing on parseObject after clearPassword mutates the String value. Trace the deserialization and String-handling entry points implicated by the difference. Done means fields whose JSON values are "1" remain readable after the sensitive-data cleanup step.

Written by the indexing model from the issue text.

Assessment

Tech stack
java
Domain
backend
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
42/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.