Skip to content

Commit 5e2c07c

Browse files
chickenljchickenlj
authored
Hessian whitelist2 (#6486)
1 parent 4a8abfd commit 5e2c07c

9 files changed

Lines changed: 184 additions & 31 deletions

File tree

‎dubbo-serialization/dubbo-serialization-hessian2/src/main/java/com/alibaba/dubbo/common/serialize/hessian2/Hessian2ObjectInput.java‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -18,6 +18,7 @@
1818

1919
import com.alibaba.com.caucho.hessian.io.Hessian2Input;
2020
import com.alibaba.dubbo.common.serialize.ObjectInput;
21+
import com.alibaba.dubbo.common.serialize.hessian2.dubbo.Hessian2FactoryUtil;
2122

2223
import java.io.IOException;
2324
import java.io.InputStream;
@@ -31,7 +32,7 @@ public class Hessian2ObjectInput implements ObjectInput {
3132

3233
public Hessian2ObjectInput(InputStream is) {
3334
mH2i = new Hessian2Input(is);
34-
mH2i.setSerializerFactory(Hessian2SerializerFactory.SERIALIZER_FACTORY);
35+
mH2i.setSerializerFactory(Hessian2FactoryUtil.getInstance().getSerializerFactory());
3536
}
3637

3738
@Override

‎dubbo-serialization/dubbo-serialization-hessian2/src/main/java/com/alibaba/dubbo/common/serialize/hessian2/Hessian2ObjectOutput.java‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -18,6 +18,7 @@
1818

1919
import com.alibaba.com.caucho.hessian.io.Hessian2Output;
2020
import com.alibaba.dubbo.common.serialize.ObjectOutput;
21+
import com.alibaba.dubbo.common.serialize.hessian2.dubbo.Hessian2FactoryUtil;
2122

2223
import java.io.IOException;
2324
import java.io.OutputStream;
@@ -30,7 +31,7 @@ public class Hessian2ObjectOutput implements ObjectOutput {
3031

3132
public Hessian2ObjectOutput(OutputStream os) {
3233
mH2o = new Hessian2Output(os);
33-
mH2o.setSerializerFactory(Hessian2SerializerFactory.SERIALIZER_FACTORY);
34+
mH2o.setSerializerFactory(Hessian2FactoryUtil.getInstance().getSerializerFactory());
3435
}
3536

3637
@Override

‎dubbo-serialization/dubbo-serialization-hessian2/src/main/java/com/alibaba/dubbo/common/serialize/hessian2/Hessian2SerializerFactory.java‎

Lines changed: 1 addition & 29 deletions
Original file line numberDiff line numberDiff line change
@@ -17,38 +17,10 @@
1717
package com.alibaba.dubbo.common.serialize.hessian2;
1818

1919
import com.alibaba.com.caucho.hessian.io.SerializerFactory;
20-
import com.alibaba.dubbo.common.utils.ConfigUtils;
21-
import com.alibaba.dubbo.common.utils.StringUtils;
2220

2321
public class Hessian2SerializerFactory extends SerializerFactory {
24-
private static final String WHITELIST = "dubbo.application.hessian2.whitelist";
25-
private static final String ALLOW = "dubbo.application.hessian2.allow";
26-
private static final String DENY = "dubbo.application.hessian2.deny";
2722

28-
public static final SerializerFactory SERIALIZER_FACTORY;
29-
30-
/**
31-
* see https://github.com/ebourg/hessian/commit/cf851f5131707891e723f7f6a9718c2461aed826
32-
*/
33-
static {
34-
SERIALIZER_FACTORY = new Hessian2SerializerFactory();
35-
String whiteList = ConfigUtils.getProperty(WHITELIST);
36-
if ("true".equals(whiteList)) {
37-
SERIALIZER_FACTORY.getClassFactory().setWhitelist(true);
38-
String allowPattern = ConfigUtils.getProperty(ALLOW);
39-
if (StringUtils.isNotEmpty(allowPattern)) {
40-
SERIALIZER_FACTORY.getClassFactory().allow(allowPattern);
41-
}
42-
} else {
43-
SERIALIZER_FACTORY.getClassFactory().setWhitelist(false);
44-
String denyPattern = ConfigUtils.getProperty(DENY);
45-
if (StringUtils.isNotEmpty(denyPattern)) {
46-
SERIALIZER_FACTORY.getClassFactory().deny(denyPattern);
47-
}
48-
}
49-
}
50-
51-
private Hessian2SerializerFactory() {
23+
public Hessian2SerializerFactory() {
5224
}
5325

5426
@Override

‎dubbo-serialization/dubbo-serialization-hessian2/src/main/java/com/alibaba/dubbo/common/serialize/hessian2/dubbo/AbstractHessian2FactoryInitializer.java‎

Lines changed: 36 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,36 @@
1+
/*
2+
* Licensed to the Apache Software Foundation (ASF) under one or more
3+
* contributor license agreements. See the NOTICE file distributed with
4+
* this work for additional information regarding copyright ownership.
5+
* The ASF licenses this file to You under the Apache License, Version 2.0
6+
* (the "License"); you may not use this file except in compliance with
7+
* the License. You may obtain a copy of the License at
8+
*
9+
* http://www.apache.org/licenses/LICENSE-2.0
10+
*
11+
* Unless required by applicable law or agreed to in writing, software
12+
* distributed under the License is distributed on an "AS IS" BASIS,
13+
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
14+
* See the License for the specific language governing permissions and
15+
* limitations under the License.
16+
*/
17+
package com.alibaba.dubbo.common.serialize.hessian2.dubbo;
18+
19+
import com.alibaba.com.caucho.hessian.io.SerializerFactory;
20+
21+
public abstract class AbstractHessian2FactoryInitializer implements Hessian2FactoryInitializer {
22+
private static SerializerFactory SERIALIZER_FACTORY;
23+
24+
@Override
25+
public SerializerFactory getSerializerFactory() {
26+
if (SERIALIZER_FACTORY != null) {
27+
return SERIALIZER_FACTORY;
28+
}
29+
synchronized (this) {
30+
SERIALIZER_FACTORY = createSerializerFactory();
31+
}
32+
return SERIALIZER_FACTORY;
33+
}
34+
35+
protected abstract SerializerFactory createSerializerFactory();
36+
}

‎dubbo-serialization/dubbo-serialization-hessian2/src/main/java/com/alibaba/dubbo/common/serialize/hessian2/dubbo/DefaultHessian2FactoryInitializer.java‎

Lines changed: 27 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,27 @@
1+
/*
2+
* Licensed to the Apache Software Foundation (ASF) under one or more
3+
* contributor license agreements. See the NOTICE file distributed with
4+
* this work for additional information regarding copyright ownership.
5+
* The ASF licenses this file to You under the Apache License, Version 2.0
6+
* (the "License"); you may not use this file except in compliance with
7+
* the License. You may obtain a copy of the License at
8+
*
9+
* http://www.apache.org/licenses/LICENSE-2.0
10+
*
11+
* Unless required by applicable law or agreed to in writing, software
12+
* distributed under the License is distributed on an "AS IS" BASIS,
13+
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
14+
* See the License for the specific language governing permissions and
15+
* limitations under the License.
16+
*/
17+
package com.alibaba.dubbo.common.serialize.hessian2.dubbo;
18+
19+
import com.alibaba.com.caucho.hessian.io.SerializerFactory;
20+
import com.alibaba.dubbo.common.serialize.hessian2.Hessian2SerializerFactory;
21+
22+
public class DefaultHessian2FactoryInitializer extends AbstractHessian2FactoryInitializer {
23+
@Override
24+
protected SerializerFactory createSerializerFactory() {
25+
return new Hessian2SerializerFactory();
26+
}
27+
}

‎dubbo-serialization/dubbo-serialization-hessian2/src/main/java/com/alibaba/dubbo/common/serialize/hessian2/dubbo/Hessian2FactoryInitializer.java‎

Lines changed: 25 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,25 @@
1+
/*
2+
* Licensed to the Apache Software Foundation (ASF) under one or more
3+
* contributor license agreements. See the NOTICE file distributed with
4+
* this work for additional information regarding copyright ownership.
5+
* The ASF licenses this file to You under the Apache License, Version 2.0
6+
* (the "License"); you may not use this file except in compliance with
7+
* the License. You may obtain a copy of the License at
8+
*
9+
* http://www.apache.org/licenses/LICENSE-2.0
10+
*
11+
* Unless required by applicable law or agreed to in writing, software
12+
* distributed under the License is distributed on an "AS IS" BASIS,
13+
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
14+
* See the License for the specific language governing permissions and
15+
* limitations under the License.
16+
*/
17+
package com.alibaba.dubbo.common.serialize.hessian2.dubbo;
18+
19+
import com.alibaba.com.caucho.hessian.io.SerializerFactory;
20+
import com.alibaba.dubbo.common.extension.SPI;
21+
22+
@SPI("default")
23+
public interface Hessian2FactoryInitializer {
24+
SerializerFactory getSerializerFactory();
25+
}

‎dubbo-serialization/dubbo-serialization-hessian2/src/main/java/com/alibaba/dubbo/common/serialize/hessian2/dubbo/Hessian2FactoryUtil.java‎

Lines changed: 36 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,36 @@
1+
/*
2+
* Licensed to the Apache Software Foundation (ASF) under one or more
3+
* contributor license agreements. See the NOTICE file distributed with
4+
* this work for additional information regarding copyright ownership.
5+
* The ASF licenses this file to You under the Apache License, Version 2.0
6+
* (the "License"); you may not use this file except in compliance with
7+
* the License. You may obtain a copy of the License at
8+
*
9+
* http://www.apache.org/licenses/LICENSE-2.0
10+
*
11+
* Unless required by applicable law or agreed to in writing, software
12+
* distributed under the License is distributed on an "AS IS" BASIS,
13+
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
14+
* See the License for the specific language governing permissions and
15+
* limitations under the License.
16+
*/
17+
package com.alibaba.dubbo.common.serialize.hessian2.dubbo;
18+
19+
import com.alibaba.dubbo.common.extension.ExtensionLoader;
20+
import com.alibaba.dubbo.common.utils.ConfigUtils;
21+
import com.alibaba.dubbo.common.utils.StringUtils;
22+
23+
public class Hessian2FactoryUtil {
24+
static String WHITELIST = "dubbo.application.hessian2.whitelist";
25+
static String ALLOW = "dubbo.application.hessian2.allow";
26+
static String DENY = "dubbo.application.hessian2.deny";
27+
static ExtensionLoader<Hessian2FactoryInitializer> loader = ExtensionLoader.getExtensionLoader(Hessian2FactoryInitializer.class);
28+
29+
public static Hessian2FactoryInitializer getInstance() {
30+
String whitelist = ConfigUtils.getProperty(WHITELIST);
31+
if (StringUtils.isNotEmpty(whitelist)) {
32+
return loader.getExtension("whitelist");
33+
}
34+
return loader.getDefaultExtension();
35+
}
36+
}

‎dubbo-serialization/dubbo-serialization-hessian2/src/main/java/com/alibaba/dubbo/common/serialize/hessian2/dubbo/WhitelistHessian2FactoryInitializer.java‎

Lines changed: 53 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,53 @@
1+
/*
2+
* Licensed to the Apache Software Foundation (ASF) under one or more
3+
* contributor license agreements. See the NOTICE file distributed with
4+
* this work for additional information regarding copyright ownership.
5+
* The ASF licenses this file to You under the Apache License, Version 2.0
6+
* (the "License"); you may not use this file except in compliance with
7+
* the License. You may obtain a copy of the License at
8+
*
9+
* http://www.apache.org/licenses/LICENSE-2.0
10+
*
11+
* Unless required by applicable law or agreed to in writing, software
12+
* distributed under the License is distributed on an "AS IS" BASIS,
13+
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
14+
* See the License for the specific language governing permissions and
15+
* limitations under the License.
16+
*/
17+
package com.alibaba.dubbo.common.serialize.hessian2.dubbo;
18+
19+
import com.alibaba.com.caucho.hessian.io.SerializerFactory;
20+
import com.alibaba.dubbo.common.serialize.hessian2.Hessian2SerializerFactory;
21+
import com.alibaba.dubbo.common.utils.ConfigUtils;
22+
import com.alibaba.dubbo.common.utils.StringUtils;
23+
24+
import static com.alibaba.dubbo.common.serialize.hessian2.dubbo.Hessian2FactoryUtil.ALLOW;
25+
import static com.alibaba.dubbo.common.serialize.hessian2.dubbo.Hessian2FactoryUtil.DENY;
26+
import static com.alibaba.dubbo.common.serialize.hessian2.dubbo.Hessian2FactoryUtil.WHITELIST;
27+
28+
/**
29+
* see https://github.com/ebourg/hessian/commit/cf851f5131707891e723f7f6a9718c2461aed826
30+
*/
31+
public class WhitelistHessian2FactoryInitializer extends AbstractHessian2FactoryInitializer {
32+
33+
@Override
34+
public SerializerFactory createSerializerFactory() {
35+
SerializerFactory serializerFactory = new Hessian2SerializerFactory();
36+
String whiteList = ConfigUtils.getProperty(WHITELIST);
37+
if ("true".equals(whiteList)) {
38+
serializerFactory.getClassFactory().setWhitelist(true);
39+
String allowPattern = ConfigUtils.getProperty(ALLOW);
40+
if (StringUtils.isNotEmpty(allowPattern)) {
41+
serializerFactory.getClassFactory().allow(allowPattern);
42+
}
43+
} else {
44+
serializerFactory.getClassFactory().setWhitelist(false);
45+
String denyPattern = ConfigUtils.getProperty(DENY);
46+
if (StringUtils.isNotEmpty(denyPattern)) {
47+
serializerFactory.getClassFactory().deny(denyPattern);
48+
}
49+
}
50+
return serializerFactory;
51+
}
52+
53+
}

‎dubbo-serialization/dubbo-serialization-hessian2/src/main/resources/META-INF/dubbo/internal/com.alibaba.dubbo.common.serialize.hessian2.dubbo.Hessian2FactoryInitializer‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,2 @@
1+
default=com.alibaba.dubbo.common.serialize.hessian2.dubbo.DefaultHessian2FactoryInitializer
2+
whitelist=com.alibaba.dubbo.common.serialize.hessian2.dubbo.WhitelistHessian2FactoryInitializer

0 commit comments

Comments
 (0)