[Bug] In `DefaultSerializeClassChecker` When the check mode is `WARN`, an exception still occurs.
- Dominant language
- Java
- Stars
- 41.6k
- Forks
- 26.4k
- Avg merge
- 15h 13m
- Merged PRs (30d)
- 4
Description
### Pre-check
- [x] I am sure that all the content I provide is in English.
### Search before asking
- [x] I had searched in the [issues](https://github.com/apache/dubbo/issues?q=is%3Aissue) and found no similar issues.
### Apache Dubbo Component
Java SDK (apache/dubbo)
### Dubbo Version
Dubbo Java 3.2.16、3.3.3
### Steps to reproduce this issue
```
@Test
void testCheckStatusWarn() throws IOException {
FrameworkModel frameworkModel = new FrameworkModel();
SerializeSecurityManager ssm = frameworkModel.getBeanFactory().getBean(SerializeSecurityManager.class);
ssm.setCheckStatus(SerializeCheckStatus.WARN);
Serialization serialization = frameworkModel.getExtensionLoader(Serialization.class)
//When using fastjson2, it's ok.
.getExtension("hessian2");
URL url = URL.valueOf("").setScopeModel(frameworkModel);
ByteArrayOutputStream outputStream = new ByteArrayOutputStream();
ObjectOutput objectOutput = serialization.serialize(url, outputStream);
objectOutput.writeObject(Level.ALL);
objectOutput.flushBuffer();
Assertions.assertDoesNotThrow(() -> serialization.deserialize(url, new
ByteArrayInputStream(outputStream.toByteArray())));
}
@Test
void testCommon() throws ClassNotFoundException {
FrameworkModel.defaultModel()
.getBeanFactory()
.getBean(SerializeSecurityManager.class)
.setCheckStatus(SerializeCheckStatus.WARN);
DefaultSerializeClassChecker defaultSerializeClassChecker = DefaultSerializeClassChecker.getInstance();
Assertions.assertDoesNotThrow(() -> {
defaultSerializeClassChecker.loadClass(
Thread.currentThread().getContextClassLoader(), Socket.class.getName());
});
Assertions.assertNotEquals(
Socket.class, defaultSerializeClassChecker.loadClass(
Thread.currentThread().getContextClassLoader(), Socket.class.getName()));
}
```
### What you expected to happen
No exceptions,Expected to be consistent with the logic and results of `Fastjson2SecurityManager`
### Anything else
_No response_
### Are you willing to submit a pull request to fix on your own?
- [x] Yes I am willing to submit a pull request on my own!
### Code of Conduct
- [x] I agree to follow this project's [Code of Conduct](https://www.apache.org/foundation/policies/conduct)
Contributor guide
Research direction
Start with the two reproductions in testCheckStatusWarn and testCommon, then inspect DefaultSerializeClassChecker.loadClass and the SerializeSecurityManager check-status handling. Run the focused tests with WARN enabled and compare the behavior with Fastjson2SecurityManager. Done means deserialization and class loading do not throw in WARN mode and the assertions pass.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- java
- Domain
- distributed-systems, security
- Issue type
- Bug
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 45/100