GithubStar/fastjson
1
0
Fork 0
mirror of https://github.com/alibaba/fastjson.git synced 2026-10-29 14:10:25 +08:00
Code Issues Packages Projects Releases Wiki Activity

refactor autotype internal white list

Browse Source
This commit is contained in:
高铁
2019-10-04 13:51:31 +08:00
parent 014444e6c6
commit ec17da70c1
2 changed files with 88 additions and 75 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/main/java/com/alibaba/fastjson/parser/ParserConfig.java
+88 -3
View File
@@ -68,6 +68,7 @@ public class ParserConfig {
public static final String[] DENYS;
private static final String[] AUTO_TYPE_ACCEPT_LIST;
public static final boolean AUTO_SUPPORT;
private static final long[] INTERNAL_WHITELIST_HASHCODES;
static {
{
@@ -86,6 +87,83 @@ public class ParserConfig {
}
AUTO_TYPE_ACCEPT_LIST = items;
}
String[] types = new String[] {
"java.awt.Rectangle",
"java.awt.Point",
"java.awt.Font",
"java.awt.Color",
"com.alibaba.fastjson.util.AntiCollisionHashMap",
"com.alipay.sofa.rpc.core.exception.SofaTimeOutException",
"java.util.Collections.UnmodifiableMap",
"java.util.concurrent.ConcurrentSkipListMap",
"java.util.concurrent.ConcurrentSkipListSet",
"org.springframework.dao.CannotAcquireLockException",
"org.springframework.dao.CannotSerializeTransactionException",
"org.springframework.dao.CleanupFailureDataAccessException",
"org.springframework.dao.ConcurrencyFailureException",
"org.springframework.dao.DataAccessResourceFailureException",
"org.springframework.dao.DataIntegrityViolationException",
"org.springframework.dao.DataRetrievalFailureException",
"org.springframework.dao.DeadlockLoserDataAccessException",
"org.springframework.dao.DuplicateKeyException",
"org.springframework.dao.EmptyResultDataAccessException",
"org.springframework.dao.IncorrectResultSizeDataAccessException",
"org.springframework.dao.IncorrectUpdateSemanticsDataAccessException",
"org.springframework.dao.InvalidDataAccessApiUsageException",
"org.springframework.dao.InvalidDataAccessResourceUsageException",
"org.springframework.dao.NonTransientDataAccessException",
"org.springframework.dao.NonTransientDataAccessResourceException",
"org.springframework.dao.OptimisticLockingFailureException",
"org.springframework.dao.PermissionDeniedDataAccessException",
"org.springframework.dao.PessimisticLockingFailureException",
"org.springframework.dao.QueryTimeoutException",
"org.springframework.dao.RecoverableDataAccessException",
"org.springframework.dao.TransientDataAccessException",
"org.springframework.dao.TransientDataAccessResourceException",
"org.springframework.dao.TypeMismatchDataAccessException",
"org.springframework.dao.UncategorizedDataAccessException",
"org.springframework.jdbc.BadSqlGrammarException",
"org.springframework.jdbc.CannotGetJdbcConnectionException",
"org.springframework.jdbc.IncorrectResultSetColumnCountException",
"org.springframework.jdbc.InvalidResultSetAccessException",
"org.springframework.jdbc.JdbcUpdateAffectedIncorrectNumberOfRowsException",
"org.springframework.jdbc.LobRetrievalFailureException",
"org.springframework.jdbc.SQLWarningException",
"org.springframework.jdbc.UncategorizedSQLException",
"org.springframework.cache.support.NullValue",
"org.springframework.security.oauth2.common.DefaultExpiringOAuth2RefreshToken",
"org.springframework.security.oauth2.common.DefaultOAuth2AccessToken",
"org.springframework.security.oauth2.common.DefaultOAuth2RefreshToken",
"org.springframework.util.LinkedMultiValueMap",
"org.springframework.util.LinkedCaseInsensitiveMap",
"org.springframework.remoting.support.RemoteInvocation",
"org.springframework.remoting.support.RemoteInvocationResult",
"org.springframework.security.web.savedrequest.DefaultSavedRequest",
"org.springframework.security.web.savedrequest.SavedCookie",
"org.springframework.security.web.csrf.DefaultCsrfToken",
"org.springframework.security.web.authentication.WebAuthenticationDetails",
"org.springframework.security.core.context.SecurityContextImpl",
"org.springframework.security.authentication.UsernamePasswordAuthenticationToken",
"org.springframework.security.core.authority.SimpleGrantedAuthority",
"org.springframework.security.core.userdetails.User",
};
long[] hashCodes = new long[types.length];
for (int i = 0; i < types.length; i++) {
hashCodes[i] = TypeUtils.fnv1a_64(types[i]);
}
Arrays.sort(hashCodes);
INTERNAL_WHITELIST_HASHCODES = hashCodes;
}
public static ParserConfig getGlobalInstance() {
@@ -207,11 +285,10 @@ public class ParserConfig {
0x7AA7EE3627A19CF3L
};
long[] hashCodes = new long[AUTO_TYPE_ACCEPT_LIST.length + 1];
long[] hashCodes = new long[AUTO_TYPE_ACCEPT_LIST.length];
for (int i = 0; i < AUTO_TYPE_ACCEPT_LIST.length; i++) {
hashCodes[i] = TypeUtils.fnv1a_64(AUTO_TYPE_ACCEPT_LIST[i]);
}
hashCodes[hashCodes.length - 1] = -6293031534589903644L;
Arrays.sort(hashCodes);
acceptHashCodes = hashCodes;
@@ -1117,7 +1194,11 @@ public class ParserConfig {
^ className.charAt(2))
* PRIME;
if (autoTypeSupport || expectClassFlag) {
boolean internalWhite = Arrays.binarySearch(INTERNAL_WHITELIST_HASHCODES,
TypeUtils.fnv1a_64(className)
) >= 0;
if ((!internalWhite) && (autoTypeSupport || expectClassFlag)) {
long hash = h3;
for (int i = 3; i < className.length(); ++i) {
hash ^= className.charAt(i);
@@ -1146,6 +1227,10 @@ public class ParserConfig {
clazz = typeMapping.get(typeName);
}
if (internalWhite) {
clazz = TypeUtils.loadClass(typeName, defaultClassLoader, true);
}
if (clazz != null) {
if (expectClass != null
&& clazz != java.util.HashMap.class
src/main/java/com/alibaba/fastjson/util/TypeUtils.java
-72
View File
@@ -1449,8 +1449,6 @@ public class TypeUtils{
java.util.ArrayList.class,
java.util.concurrent.TimeUnit.class,
java.util.concurrent.ConcurrentHashMap.class,
loadClass("java.util.concurrent.ConcurrentSkipListMap"),
loadClass("java.util.concurrent.ConcurrentSkipListSet"),
java.util.concurrent.atomic.AtomicInteger.class,
java.util.concurrent.atomic.AtomicLong.class,
java.util.Collections.EMPTY_MAP.getClass(),
@@ -1485,76 +1483,6 @@ public class TypeUtils{
}
mappings.put(clazz.getName(), clazz);
}
String[] w = new String[]{
"java.util.Collections$UnmodifiableMap"
};
for(String className : w){
Class<?> clazz = loadClass(className);
if(clazz == null){
break;
}
mappings.put(clazz.getName(), clazz);
}
String[] awt = new String[]{
"java.awt.Rectangle",
"java.awt.Point",
"java.awt.Font",
"java.awt.Color"};
for(String className : awt){
Class<?> clazz = loadClass(className);
if(clazz == null){
break;
}
mappings.put(clazz.getName(), clazz);
}
String[] spring = new String[]{
"org.springframework.util.LinkedMultiValueMap",
"org.springframework.util.LinkedCaseInsensitiveMap",
"org.springframework.remoting.support.RemoteInvocation",
"org.springframework.remoting.support.RemoteInvocationResult",
"org.springframework.security.web.savedrequest.DefaultSavedRequest",
"org.springframework.security.web.savedrequest.SavedCookie",
"org.springframework.security.web.csrf.DefaultCsrfToken",
"org.springframework.security.web.authentication.WebAuthenticationDetails",
"org.springframework.security.core.context.SecurityContextImpl",
"org.springframework.security.authentication.UsernamePasswordAuthenticationToken",
"org.springframework.security.core.authority.SimpleGrantedAuthority",
"org.springframework.security.core.userdetails.User",
"org.springframework.security.oauth2.common.DefaultExpiringOAuth2RefreshToken",
"org.springframework.security.oauth2.common.DefaultOAuth2AccessToken",
"org.springframework.security.oauth2.common.DefaultOAuth2RefreshToken",
"org.springframework.cache.support.NullValue",
"org.springframework.jdbc.UncategorizedSQLException",
"org.springframework.dao.CannotAcquireLockException",
"org.springframework.dao.DuplicateKeyException",
"org.springframework.dao.QueryTimeoutException",
"org.springframework.dao.TransientDataAccessException",
"org.springframework.dao.TypeMismatchDataAccessException",
"org.springframework.dao.UncategorizedDataAccessException",
"org.springframework.dao.DataAccessResourceFailureException",
};
for(String className : spring){
Class<?> clazz = loadClass(className);
if(clazz == null){
continue;
}
mappings.put(clazz.getName(), clazz);
}
String[] sofa = new String[] {
"com.alipay.sofa.rpc.core.exception.SofaTimeOutException",
};
for(String className : sofa){
Class<?> clazz = loadClass(className);
if(clazz == null){
continue;
}
mappings.put(clazz.getName(), clazz);
}
}
public static void clearClassMapping(){