fix: auto-trust array component types during serialization scanning

dubbo-common/src/main/java/org/apache/dubbo/common/utils/SerializeSecurityConfigurator.java

@@ -302,7 +302,12 @@ private boolean checkClass(Class<?> clazz) {
 
         addToAllow(clazz);
 
-        if (ClassUtils.isSimpleType(clazz) || clazz.isPrimitive() || clazz.isArray()) {
+        if (clazz.isArray()) {
+            checkClass(clazz.getComponentType());
+            return true;
+        }
+
+        if (ClassUtils.isSimpleType(clazz) || clazz.isPrimitive()) {
             return true;
         }
         String className = clazz.getName();

dubbo-common/src/test/java/com/pojo/ArrayPayload.java

@@ -0,0 +1,31 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one or more
+ * contributor license agreements.  See the NOTICE file distributed with
+ * this work for additional information regarding copyright ownership.
+ * The ASF licenses this file to You under the Apache License, Version 2.0
+ * (the "License"); you may not use this file except in compliance with
+ * the License.  You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+package com.pojo;
+
+import java.io.Serializable;
+
+/**
+ * Array element with nested and recursive fields for serialization trust tests.
+ *
+ * @date 2026-11-04
+ */
+public class ArrayPayload implements Serializable {
+    private Detail detail;
+    private ArrayPayload[] children;
+
+    public static class Detail implements Serializable {}
+}

dubbo-common/src/test/java/org/apache/dubbo/common/utils/SerializeSecurityConfiguratorTest.java

@@ -28,7 +28,10 @@
 import java.util.Map;
 import java.util.Set;
 import java.util.Vector;
+import java.util.stream.Stream;
 
+import com.pojo.ArrayPayload;
+import com.pojo.Demo1;
 import com.service.DemoService1;
 import com.service.DemoService2;
 import com.service.DemoService4;
@@ -39,9 +42,70 @@
 import com.service.deep1.deep2.deep3.DemoService3;
 import org.junit.jupiter.api.Assertions;
 import org.junit.jupiter.api.Test;
+import org.junit.jupiter.params.ParameterizedTest;
+import org.junit.jupiter.params.provider.MethodSource;
 
 class SerializeSecurityConfiguratorTest {
 
+    @ParameterizedTest
+    @MethodSource("arrayServices")
+    void testArrayComponentTypes(Class<?> serviceInterface) throws ClassNotFoundException {
+        FrameworkModel frameworkModel = new FrameworkModel();
+        try {
+            ApplicationModel applicationModel = frameworkModel.newApplication();
+            ApplicationConfig applicationConfig = new ApplicationConfig("array-test");
+            applicationConfig.setSerializeCheckStatus(SerializeCheckStatus.STRICT.name());
+            applicationModel.getApplicationConfigManager().setApplication(applicationConfig);
+            ModuleModel moduleModel = applicationModel.newModule();
+            SerializeSecurityConfigurator configurator = new SerializeSecurityConfigurator(moduleModel);
+            DefaultSerializeClassChecker checker =
+                    frameworkModel.getBeanFactory().getBean(DefaultSerializeClassChecker.class);
+            SerializeSecurityManager manager = frameworkModel.getBeanFactory().getBean(SerializeSecurityManager.class);
+            ClassLoader classLoader = ArrayPayload.class.getClassLoader();
+
+            Assertions.assertThrows(
+                    IllegalArgumentException.class, () -> checker.loadClass(classLoader, ArrayPayload.class.getName()));
+
+            configurator.registerInterface(serviceInterface);
+
+            Assertions.assertSame(ArrayPayload.class, checker.loadClass(classLoader, ArrayPayload.class.getName()));
+            Assertions.assertTrue(manager.getAllowedPrefix().contains(ArrayPayload.Detail.class.getName()));
+            IllegalArgumentException failure = Assertions.assertThrows(
+                    IllegalArgumentException.class, () -> checker.loadClass(classLoader, Demo1.class.getName()));
+            Assertions.assertTrue(failure.getMessage().contains("is not in allow list"));
+        } finally {
+            frameworkModel.destroy();
+        }
+    }
+
+    static Stream<Class<?>> arrayServices() {
+        return Stream.of(
+                ArrayParameterService.class,
+                ArrayReturnService.class,
+                MultidimensionalArrayService.class,
+                ArrayFieldService.class);
+    }
+
+    interface ArrayParameterService {
+        void accept(ArrayPayload[] values);
+    }
+
+    interface ArrayReturnService {
+        ArrayPayload[] read();
+    }
+
+    interface MultidimensionalArrayService {
+        ArrayPayload[][] read();
+    }
+
+    interface ArrayFieldService {
+        ArrayEnvelope read();
+    }
+
+    static class ArrayEnvelope {
+        private ArrayPayload[] values;
+    }
+
     @Test
     void test() {
         FrameworkModel frameworkModel = new FrameworkModel();