apache / apache/dubbo

[Bug] In `DefaultSerializeClassChecker` When the check mode is `WARN`, an exception still occurs.

Open
#15,179 2 comments 0 reactions 0 assignees View on GitHub
help wanted type/enhancement
Dominant language
Java
Stars
41.6k
Forks
26.4k
Avg merge
15h 13m
Merged PRs (30d)
4

Description

### Pre-check

- [x] I am sure that all the content I provide is in English.

### Search before asking

- [x] I had searched in the [issues](https://github.com/apache/dubbo/issues?q=is%3Aissue) and found no similar issues.

### Apache Dubbo Component

Java SDK (apache/dubbo)

### Dubbo Version

Dubbo Java 3.2.16、3.3.3

### Steps to reproduce this issue

```
@Test
void testCheckStatusWarn() throws IOException {
FrameworkModel frameworkModel = new FrameworkModel();
SerializeSecurityManager ssm = frameworkModel.getBeanFactory().getBean(SerializeSecurityManager.class);
ssm.setCheckStatus(SerializeCheckStatus.WARN);

Serialization serialization = frameworkModel.getExtensionLoader(Serialization.class)
//When using fastjson2, it's ok.
.getExtension("hessian2");
URL url = URL.valueOf("").setScopeModel(frameworkModel);
ByteArrayOutputStream outputStream = new ByteArrayOutputStream();
ObjectOutput objectOutput = serialization.serialize(url, outputStream);
objectOutput.writeObject(Level.ALL);
objectOutput.flushBuffer();

Assertions.assertDoesNotThrow(() -> serialization.deserialize(url, new
ByteArrayInputStream(outputStream.toByteArray())));
}

@Test
void testCommon() throws ClassNotFoundException {
FrameworkModel.defaultModel()
.getBeanFactory()
.getBean(SerializeSecurityManager.class)
.setCheckStatus(SerializeCheckStatus.WARN);
DefaultSerializeClassChecker defaultSerializeClassChecker = DefaultSerializeClassChecker.getInstance();

Assertions.assertDoesNotThrow(() -> {
defaultSerializeClassChecker.loadClass(
Thread.currentThread().getContextClassLoader(), Socket.class.getName());
});
Assertions.assertNotEquals(
Socket.class, defaultSerializeClassChecker.loadClass(
Thread.currentThread().getContextClassLoader(), Socket.class.getName()));
}
```

### What you expected to happen

No exceptions,Expected to be consistent with the logic and results of `Fastjson2SecurityManager`

### Anything else

_No response_

### Are you willing to submit a pull request to fix on your own?

- [x] Yes I am willing to submit a pull request on my own!

### Code of Conduct

- [x] I agree to follow this project's [Code of Conduct](https://www.apache.org/foundation/policies/conduct)

Contributor guide

Open the contributing guide

Research direction

Start with the two reproductions in testCheckStatusWarn and testCommon, then inspect DefaultSerializeClassChecker.loadClass and the SerializeSecurityManager check-status handling. Run the focused tests with WARN enabled and compare the behavior with Fastjson2SecurityManager. Done means deserialization and class loading do not throw in WARN mode and the assertions pass.

Written by the indexing model from the issue text.

Assessment

Tech stack
java
Domain
distributed-systems, security
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
45/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.