alibaba / alibaba/fastjson2

[BUG]

Open
#7,792 0 comments 0 reactions 0 assignees View on GitHub
bug
Dominant language
Java
Stars
4.4k
Forks
613
Avg merge
1d 22h
Merged PRs (30d)
6

Description

### 问题描述
从 2.0.57 升级到 2.0.63 后,Android 应用在序列化 Bean 对象时立即崩溃。2.0.57 无此问题。

由于 ≤ 2.0.62 存在 RCE 漏洞(漏洞详情 (https://github.com/Detect-DefenseLab/fas…)),需要升级到 ≥ 2.0.63。但 2.0.63 在 Android 上崩溃,且目前 没有 ≥ 2.0.63 的 Android
专用版本,导致无法同时满足"修复漏洞"和"Android 兼容"。

### 环境信息

- fastjson2 版本:2.0.63
- 运行环境:Android(ART 虚拟机)
- 此前正常版本:2.0.57

### 重现步骤
1. 创建 Android 项目,引入 fastjson2 2.0.63:
implementation 'com.alibaba.fastjson2:fastjson2:2.0.63'

2. 定义一个包含 String 字段的 Bean 类:
public class TestBean {
private String channelId;
private int streamType;

public String getChannelId() { return channelId; }
public void setChannelId(String channelId) { this.channelId = channelId; }
public int getStreamType() { return streamType; }
public void setStreamType(int streamType) { this.streamType = streamType; }
}

3. 在任意 Activity 的 onCreate 中调用:
TestBean bean = new TestBean();
bean.setChannelId("ch_001");
bean.setStreamType(1);

// 触发崩溃
Object result = JSON.toJSON(Collections.singletonList(bean));

4. 在 Android 真机或模拟器上运行,App 立即崩溃

---
关键条件:
- 标准版本 2.0.63
- 必须运行在 Android ART 虚拟机上(真机或模拟器)
- 序列化对象包含 String 类型字段(崩溃路径经过 FieldWriterString)

### 期待的正确结果
app正常运行

### 相关日志输出
崩溃堆栈

com.alibaba.fastjson2.JSONException: toJSONString error
at com.alibaba.fastjson2.JSON.toJSON(JSON.java:4092)
at com.alibaba.fastjson2.JSON.toJSON(JSON.java:4056)
at com.jovision.jvplay.JvmpInstance.connect(LiveVideoCache.java:289)

Caused by: java.lang.NullPointerException: Attempt to invoke virtual method
'java.lang.invoke.MethodHandles$Lookup.in(java.lang.Class)' on a null object reference
at com.alibaba.fastjson2.util.JDKUtils.trustedLookup(JDKUtils.java:519)
at com.alibaba.fastjson2.introspect.PropertyAccessorFactoryLambda.getObject(PropertyAccessorFactoryLambda.java:504)
at com.alibaba.fastjson2.introspect.PropertyAccessorFactoryLambda.create(PropertyAccessorFactoryLambda.java:310)
at com.alibaba.fastjson2.introspect.PropertyAccessorFactory.create(PropertyAccessorFactory.java:2806)
at com.alibaba.fastjson2.introspect.PropertyAccessorFactory.create(PropertyAccessorFactory.java:2791)
at com.alibaba.fastjson2.writer.FieldWriter.createPropertyAccessor(FieldWriter.java:222)
at com.alibaba.fastjson2.writer.FieldWriterString.(FieldWriterString.java:25)
at com.alibaba.fastjson2.writer.ObjectWriterCreator.createFieldWriter(ObjectWriterCreator.java:1428)
at com.alibaba.fastjson2.writer.ObjectWriterCreator.createObjectWriter(ObjectWriterCreator.java:509)
at com.alibaba.fastjson2.writer.ObjectWriterImplList.write(ObjectWriterImplList.java:348)
at com.alibaba.fastjson2.JSON.toJSON(JSON.java:4089)

#### 附加信息
根因分析

2.0.63 新增 PropertyAccessorFactoryLambda,通过 MethodHandles$Lookup + LambdaMetafactory 创建属性访问器以加速序列化。但 Android ART 虚拟机的 MethodHandles 实现与标准 JDK 不同,JDKUtils.trustedLookup() 在
Android 上返回 null,导致后续 Lookup.in(Class) 调用 NPE。

已尝试的无效方案

1. System.setProperty("fastjson2.creator", "reflect") — 无效。JSONFactory.CREATOR 只控制 ObjectWriterCreator 的选择,PropertyAccessorFactory 内部独立调用
PropertyAccessorFactoryLambda.create(),不受该属性控制

Contributor guide

Open the contributing guide

Research direction

Reproduce the crash on an Android ART device or emulator using the Bean and JSON.toJSON call described in the issue. Start with JDKUtils.java at trustedLookup(), then inspect PropertyAccessorFactoryLambda.java and FieldWriterString.java to trace the failing path. Done means fastjson2 2.0.63 or later serializes the Bean on Android without crashing while retaining the security fix.

Written by the indexing model from the issue text.

Assessment

Tech stack
android, java
Domain
mobile-dev
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Active
Clarity
Clearly specified
Newbie friendliness
68/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.