[BUG]fastjson2 2.0.28一直到最新版本特定情况下反序列化字段读取值错误
- Dominant language
- Java
- Stars
- 4.4k
- Forks
- 613
- Avg merge
- 1d 22h
- Merged PRs (30d)
- 6
Description
### 问题描述
fastjson2 2.0.28一直到最新版本,在对json字符串反序列化的时候,如果有字段为字符串"1",并且在反序列化之前对相应字符串做过以下操作时,

然后再序列化时读取不到值
### 环境信息
- OS信息: [e.g.:CentOS 7、win10等系统]
- JDK信息: [e.g.:Openjdk 1.8.0_312]
- 版本信息:[e.g.:Fastjson2 2..0.28]
### 重现步骤
1. 使用 下面代码测试,目前测试只有字符串"1"会出现问题,2.0.27和之前的版本解析没问题,错误如图:

读取不到所有值为“1”的字段了
【测试代码】
```java
public class TestFastJson {
public static void main(String[] args) {
User user = new User();
user.setId("test1");
user.setName("1");
user.setPassword("1");
String str1 = JSONObject.toJSONString(user);
JSONObject jsonObject = JSONObject.parseObject(str1);
// 模拟清理内存中的密码
clearPassword(jsonObject.getString("password"));
JSONObject jsonObject2 = JSONObject.parseObject(str1);
}
private static void clearPassword(String pw) {
try {
Field field = String.class.getDeclaredField("value");
field.setAccessible(true);
char[] value = (char[]) field.get(pw);
Arrays.fill(value,'\u0000');
} catch (NoSuchFieldException e) {
e.printStackTrace();
} catch (IllegalAccessException e) {
e.printStackTrace();
}
}
}
```
### 期待的正确结果
希望能够正常反序列化,业务代码经常会有清除内存敏感数据的场景,不确定是否还有别的问题,希望能够解答问题的具体原因,十分感谢
Contributor guide
Research direction
Start by running the supplied Java reproducer against fastjson2 2.0.27 and the latest version, focusing on parseObject after clearPassword mutates the String value. Trace the deserialization and String-handling entry points implicated by the difference. Done means fields whose JSON values are "1" remain readable after the sensitive-data cleanup step.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- java
- Domain
- backend
- Issue type
- Bug
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 42/100