Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Hessian2 whitelist #6378

Merged
merged 5 commits into from
Jul 3, 2020
Merged

Hessian2 whitelist #6378

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
5 commits
Select commit Hold shift + click to select a range
55b085d
fix NPE when check=false is set and provider is empty.
chickenlj Jun 28, 2020
60ebc3a
hessian2 whitelist support
chickenlj Jun 28, 2020
5c5a640
Merge branch 'master' into hessian2-whitelist
chickenlj Jun 28, 2020
cbcaa11
only support hessian v3.2.8 is ok
chickenlj Jun 29, 2020
efe3846
hessian 3.2.8
chickenlj Jun 30, 2020
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion dubbo-dependencies-bom/pom.xml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -152,7 +152,7 @@
<activation_version>1.2.0</activation_version>
<test_container_version>1.11.2</test_container_version>
<etcd_launcher_version>0.3.0</etcd_launcher_version>
<hessian_lite_version>3.2.7</hessian_lite_version>
<hessian_lite_version>3.2.8</hessian_lite_version>
<swagger_version>1.5.19</swagger_version>
<spring_test_version>4.3.16.RELEASE</spring_test_version>

Expand Down
29 changes: 28 additions & 1 deletion ...2/src/main/java/org/apache/dubbo/common/serialize/hessian2/Hessian2SerializerFactory.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -16,11 +16,38 @@
*/
package org.apache.dubbo.common.serialize.hessian2;

import org.apache.dubbo.common.config.ConfigurationUtils;
import org.apache.dubbo.common.utils.StringUtils;

import com.alibaba.com.caucho.hessian.io.SerializerFactory;

public class Hessian2SerializerFactory extends SerializerFactory {
private static final String WHITELIST = "dubbo.application.hessian2.whitelist";
private static final String ALLOW = "dubbo.application.hessian2.allow";
private static final String DENY = "dubbo.application.hessian2.deny";

public static final SerializerFactory SERIALIZER_FACTORY;

public static final SerializerFactory SERIALIZER_FACTORY = new Hessian2SerializerFactory();
/**
* see https://github.com/ebourg/hessian/commit/cf851f5131707891e723f7f6a9718c2461aed826
*/
static {
SERIALIZER_FACTORY = new Hessian2SerializerFactory();
String whiteList = ConfigurationUtils.getProperty(WHITELIST);
if ("true".equals(whiteList)) {
SERIALIZER_FACTORY.getClassFactory().setWhitelist(true);
String allowPattern = ConfigurationUtils.getProperty(ALLOW);
if (StringUtils.isNotEmpty(allowPattern)) {
SERIALIZER_FACTORY.getClassFactory().allow(allowPattern);
}
} else {
SERIALIZER_FACTORY.getClassFactory().setWhitelist(false);
String denyPattern = ConfigurationUtils.getProperty(DENY);
if (StringUtils.isNotEmpty(denyPattern)) {
SERIALIZER_FACTORY.getClassFactory().deny(denyPattern);
}
}
}

private Hessian2SerializerFactory() {
}
Expand Down