LegendPei commented on code in PR #7973: URL: https://github.com/apache/incubator-seata/pull/7973#discussion_r3015051109
########## json-common/src/main/java/org/apache/seata/common/json/JsonAllowlistManager.java: ########## @@ -0,0 +1,301 @@ +/* + * Licensed to the Apache Software Foundation (ASF) under one or more + * contributor license agreements. See the NOTICE file distributed with + * this work for additional information regarding copyright ownership. + * The ASF licenses this file to You under the Apache License, Version 2.0 + * (the "License"); you may not use this file except in compliance with + * the License. You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, software + * distributed under the License is distributed on an "AS IS" BASIS, + * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + * See the License for the specific language governing permissions and + * limitations under the License. + */ +package org.apache.seata.common.json; + +import java.util.Map; +import java.util.Set; +import java.util.concurrent.ConcurrentHashMap; + +/** + * JSON deserialization allowlist manager. + */ +public class JsonAllowlistManager { + + private static final JsonAllowlistManager INSTANCE = new JsonAllowlistManager(); + + /** + * Built-in exact match allowlist + */ + private final Set<String> builtinClasses = ConcurrentHashMap.newKeySet(); + + /** + * Built-in prefix match allowlist + */ + private final Set<String> builtinPrefixes = ConcurrentHashMap.newKeySet(); + + /** + * User-defined exact match allowlist + */ + private final Set<String> userClasses = ConcurrentHashMap.newKeySet(); + + /** + * User-defined prefix match allowlist + */ + private final Set<String> userPrefixes = ConcurrentHashMap.newKeySet(); + + /** + * Check result cache (className -> allowed) + */ + private final Map<String, Boolean> cache = new ConcurrentHashMap<>(); + + private JsonAllowlistManager() { + initBuiltinAllowlist(); + } + + public static JsonAllowlistManager getInstance() { + return INSTANCE; + } + + /** + * Load user allowlist from configuration string + */ + public void loadUserAllowlist(String config) { + userClasses.clear(); + userPrefixes.clear(); + cache.clear(); + if (config == null || config.isEmpty()) { + return; + } + for (String item : config.split(",")) { + String trimmed = item.trim(); + if (trimmed.isEmpty()) { + continue; + } + if (trimmed.endsWith(".")) { + userPrefixes.add(trimmed); + } else { + userClasses.add(trimmed); + } + } + } + + /** + * Add a class to user allowlist programmatically + */ + public void addUserClass(String className) { + if (className != null && !className.isEmpty()) { + userClasses.add(className); + cache.remove(className); + } + } + + /** + * Add a prefix to user allowlist programmatically + */ + public void addUserPrefix(String prefix) { + if (prefix != null && !prefix.isEmpty()) { + userPrefixes.add(prefix); + cache.clear(); + } + } + + /** + * Check if a class is allowed for deserialization + */ + public boolean isAllowed(String className) { + if (className == null) { + return false; + } + return cache.computeIfAbsent(className, this::doCheck); + } + + /** + * Check if a class is allowed, throw SecurityException if not + */ + public void checkClass(String className) { + if (!isAllowed(className)) { + throw new SecurityException("Class not in JSON deserialization allowlist: " + className + + ". Please add it to seata.json.allowlist configuration."); + } + } + + /** + * Clear user allowlist and cache. + */ + public void clearUserAllowlist() { + userClasses.clear(); + userPrefixes.clear(); + cache.clear(); + } + + private boolean doCheck(String className) { + if (isExactOrPrefixAllowed(className)) { + return true; + } + if (isPrimitiveArrayDescriptor(className)) { + return true; + } + String componentClassName = extractArrayComponentClassName(className); + return componentClassName != null && isExactOrPrefixAllowed(componentClassName); + } + + /** + * Check if className is a multi-dimensional primitive array descriptor (e.g. "[[I", "[[Z"). + * Single-dimensional primitive arrays (e.g. "[I") are already in the builtin allowlist. + */ + private boolean isPrimitiveArrayDescriptor(String className) { + if (className == null || !className.startsWith("[[")) { + return false; + } + String stripped = className; + while (stripped.startsWith("[")) { + stripped = stripped.substring(1); + } + return stripped.length() == 1 && PRIMITIVE_DESCRIPTORS.indexOf(stripped.charAt(0)) >= 0; + } + + private boolean isExactOrPrefixAllowed(String className) { + if (builtinClasses.contains(className)) { + return true; + } + for (String prefix : builtinPrefixes) { + if (className.startsWith(prefix)) { + return true; + } + } + if (userClasses.contains(className)) { + return true; + } + for (String prefix : userPrefixes) { + if (className.startsWith(prefix)) { + return true; + } + } + return false; + } + + private static final String PRIMITIVE_DESCRIPTORS = "BCSIJFDZ"; + + private String extractArrayComponentClassName(String className) { + if (className == null || className.isEmpty()) { + return null; + } + + // Canonical name format: e.g. "int[][]", "String[]" + String normalized = className; + while (normalized.endsWith("[]")) { + normalized = normalized.substring(0, normalized.length() - 2); + } + if (!normalized.equals(className)) { + return normalized; + } + + // JVM descriptor format: e.g. "[[I", "[Ljava.lang.String;" + if (!normalized.startsWith("[")) { + return null; + } + while (normalized.startsWith("[")) { + normalized = normalized.substring(1); + } + // Primitive descriptor (e.g. "I", "Z") — handled by isPrimitiveArrayDescriptor + if (normalized.length() == 1) { + return null; + } + // Object descriptor: Lclassname; + if (normalized.startsWith("L") && normalized.endsWith(";")) { + return normalized.substring(1, normalized.length() - 1); + } + return null; + } + + private void initBuiltinAllowlist() { + + builtinClasses.add("java.lang.Boolean"); Review Comment: 主要是参考了Dubbo的serialize.allowlist，Dubbo对JDK类同样采用精确类名匹配，没有使用包前缀放行，原因是java.lang.*、java.util.* 等包下有 Runtime、ProcessBuilder、ServiceLoader等危险类，前缀放行会引入安全风险 -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
