apache / apache/fory

dubbo-serialization-fury allowList/allowListPrefix doesn't take affect

Closed
#1,651 1 comment 0 reactions 0 assignees View on GitHub
enhancement good first issue
Dominant language
Java
Stars
4.5k
Forks
443
Avg merge
5h 59m
Merged PRs (30d)
77

Description

## Is your feature request related to a problem? Please describe.

When Dubbo class serialization security check is enabled:
```
dubbo.application.serialize-check-status=STRICT
dubbo.application.auto-trust-serialize-class=true
dubbo.application.trust-serialize-class-level=3
```

Dubbo Serialization Fury keeps running an exception during deserialization, indicating that it is not in the serialization allowlist.

After debugging, the reason for this exception is that FuryCheckerListener#notifyPrefix method calls AllowListChecker without adding `*` to the allowedList and Fury AllowListChecker uses the suffix character `*` to determine whether it is a prefix match or an exact match..

For example, for DTO `io.github.playground.server.model.User`, the allowedList finally parsed by the dubbo security mechanism `io.github.playground` is added to AllowListChecker through FuryCheckerListener and saved in allowList instead of allowListPrefix.

## Describe the solution you'd like

FuryCheckerListener adapts to AllowListChecker by appending the suffix character `*` .

## Additional context

dubbo: 3.2
dubbo-serialization-fury: 3.2.0
dubbo security mechanism: https://cn.dubbo.apache.org/en/docs3-v2/java-sdk/advanced-features-and-usage/security/class-check/

Contributor guide

Open the contributing guide

Research direction

Start with FuryCheckerListener#notifyPrefix and trace how it passes entries to Fury's AllowListChecker, then compare the handling of allowList and allowListPrefix. Done means prefix entries are recognized during deserialization without the reported serialization allowlist exception; verify with the Dubbo security configuration and DTO example described in the issue.

Written by the indexing model from the issue text.

Assessment

Tech stack
java
Domain
backend, security
Issue type
Bug
Difficulty
2/5
Estimated time
1-3 hours
Activity status
Stale
Clarity
Clearly specified
Newbie friendliness
45/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.