mirror of
https://github.com/alibaba/fastjson.git
synced 2026-10-29 14:10:25 +08:00
Shaojin Wen
ad353ff71e
Backport of fastjson2 #7703 to 1.2.83: - Reject type names containing URL-special characters (: and !) in ParserConfig.checkAutoType and TypeUtils.loadClass, so a non-class-name string (e.g. a jar: URL) never reaches the class loader. - Verify the accept name text after a whitelist hash match: maintain a parallel acceptNameSet alongside acceptHashCodes so a hash collision alone cannot whitelist a type name. Accept names are hashed with $ normalized to ., matching the rolling hash in checkAutoType. - An accept prefix no longer covers ClassLoader/DataSource/RowSet gadget base types; only an accept entry naming the type in full is an explicit opt-in. Prefix matches are loaded without populating the class mapping cache, otherwise the denied class would be served from the cache later in the same call. - Never cache in the final loadClass of checkAutoType: previously a deny class rejected by the blacklist was still cached, so a second checkAutoType call for the same name returned it without any blacklist check. The accepted paths already call TypeUtils.addMapping explicitly.
fastjson
Fastjson is a Java library that can be used to convert Java Objects into their JSON representation. It can also be used to convert a JSON string to an equivalent Java object. Fastjson can work with arbitrary Java objects including pre-existing objects that you do not have source-code of.
Fastjson Goals
- Provide the best performance on the server-side and android client
- Provide simple toJSONString() and parseObject() methods to convert Java objects to JSON and vice-versa
- Allow pre-existing unmodifiable objects to be converted to and from JSON
- Extensive support of Java Generics
- Allow custom representations for objects
- Support arbitrarily complex objects (with deep inheritance hierarchies and extensive use of generic types)
Documentation
Benchmark
https://github.com/eishay/jvm-serializers/wiki
Download
Maven
<dependency>
<groupId>com.alibaba</groupId>
<artifactId>fastjson</artifactId>
<version>1.2.76</version>
</dependency>
<dependency>
<groupId>com.alibaba</groupId>
<artifactId>fastjson</artifactId>
<version>1.1.72.android</version>
</dependency>
Gradle via JCenter
compile 'com.alibaba:fastjson:1.2.76'
compile 'com.alibaba:fastjson:1.1.72.android'
Please see this Wiki Download Page for more repository info.
License
Fastjson is released under the Apache 2.0 license.
Copyright 1999-2020 Alibaba Group Holding Ltd.
Licensed under the Apache License, Version 2.0 (the "License");
you may not use this file except in compliance with the License.
You may obtain a copy of the License at the following link.
http://www.apache.org/licenses/LICENSE-2.0
Unless required by applicable law or agreed to in writing, software
distributed under the License is distributed on an "AS IS" BASIS,
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
See the License for the specific language governing permissions and
limitations under the License.