Skip to content

Commit a52c312

Browse files
karsontokarsonto
authored
Hessian Serializer add whitelist (#5146)
1 parent b72d4f8 commit a52c312

File tree

5 files changed

+226
-4
lines changed

5 files changed

+226
-4
lines changed

Diff for: ‎eventmesh-meta/eventmesh-meta-raft/build.gradle

+1
Original file line numberDiff line numberDiff line change
@@ -40,6 +40,7 @@ dependencies {
4040
implementation project(":eventmesh-common")
4141
implementation "com.alipay.sofa:jraft-core:${jraftVersion}"
4242
implementation "com.alipay.sofa:rpc-grpc-impl:${jraftVersion}"
43+
implementation group: 'com.caucho', name: 'hessian', version: '4.0.63'
4344
testImplementation 'org.junit.jupiter:junit-jupiter'
4445
}
4546

Diff for: ‎eventmesh-meta/eventmesh-meta-raft/src/main/java/org/apache/eventmesh/meta/raft/JraftMetaServiceImpl.java

+2-2
Original file line numberDiff line numberDiff line change
@@ -18,13 +18,13 @@
1818
package org.apache.eventmesh.meta.raft;
1919

2020
import org.apache.eventmesh.meta.raft.rpc.RequestResponse;
21+
import org.apache.eventmesh.meta.raft.serialize.EventMeshHessianSerializer;
2122

2223
import org.apache.commons.lang.StringUtils;
2324

2425
import java.nio.ByteBuffer;
2526

2627
import com.alipay.remoting.exception.CodecException;
27-
import com.alipay.remoting.serialization.SerializerManager;
2828
import com.alipay.sofa.jraft.Status;
2929
import com.alipay.sofa.jraft.entity.Task;
3030
import com.alipay.sofa.jraft.error.RaftError;
@@ -51,7 +51,7 @@ public void applyOperation(EventOperation opreation, EventClosure closure) {
5151
try {
5252
closure.setEventOperation(opreation);
5353
final Task task = new Task();
54-
task.setData(ByteBuffer.wrap(SerializerManager.getSerializer(SerializerManager.Hessian2).serialize(opreation)));
54+
task.setData(ByteBuffer.wrap(EventMeshHessianSerializer.getInstance().serialize(opreation)));
5555
task.setDone(closure);
5656
this.server.getNode().apply(task);
5757
} catch (CodecException e) {

Diff for: ‎eventmesh-meta/eventmesh-meta-raft/src/main/java/org/apache/eventmesh/meta/raft/MetaStateMachine.java

+2-2
Original file line numberDiff line numberDiff line change
@@ -21,6 +21,7 @@
2121
import static org.apache.eventmesh.meta.raft.EventOperation.GET;
2222
import static org.apache.eventmesh.meta.raft.EventOperation.PUT;
2323

24+
import org.apache.eventmesh.meta.raft.serialize.EventMeshHessianSerializer;
2425
import org.apache.eventmesh.meta.raft.snapshot.MetaSnapshotFile;
2526

2627
import org.apache.commons.lang.StringUtils;
@@ -37,7 +38,6 @@
3738
import java.util.concurrent.atomic.AtomicLong;
3839

3940
import com.alipay.remoting.exception.CodecException;
40-
import com.alipay.remoting.serialization.SerializerManager;
4141
import com.alipay.sofa.jraft.Closure;
4242
import com.alipay.sofa.jraft.Iterator;
4343
import com.alipay.sofa.jraft.Status;
@@ -121,7 +121,7 @@ public void onApply(Iterator iter) {
121121
// Have to parse FetchAddRequest from this user log.
122122
final ByteBuffer data = iter.getData();
123123
try {
124-
eventOperation = SerializerManager.getSerializer(SerializerManager.Hessian2)
124+
eventOperation = EventMeshHessianSerializer.getInstance()
125125
.deserialize(data.array(), EventOperation.class.getName());
126126
} catch (final CodecException e) {
127127
e.printStackTrace(System.err);

Diff for: ‎eventmesh-meta/eventmesh-meta-raft/src/main/java/org/apache/eventmesh/meta/raft/serialize/EventMeshHessianSerializer.java

+78
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,78 @@
1+
/*
2+
* Licensed to the Apache Software Foundation (ASF) under one or more
3+
* contributor license agreements. See the NOTICE file distributed with
4+
* this work for additional information regarding copyright ownership.
5+
* The ASF licenses this file to You under the Apache License, Version 2.0
6+
* (the "License"); you may not use this file except in compliance with
7+
* the License. You may obtain a copy of the License at
8+
*
9+
* http://www.apache.org/licenses/LICENSE-2.0
10+
*
11+
* Unless required by applicable law or agreed to in writing, software
12+
* distributed under the License is distributed on an "AS IS" BASIS,
13+
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
14+
* See the License for the specific language governing permissions and
15+
* limitations under the License.
16+
*/
17+
18+
package org.apache.eventmesh.meta.raft.serialize;
19+
20+
import java.io.ByteArrayInputStream;
21+
import java.io.ByteArrayOutputStream;
22+
import java.io.IOException;
23+
24+
import com.alipay.remoting.exception.CodecException;
25+
import com.alipay.remoting.serialization.HessianSerializer;
26+
import com.caucho.hessian.io.Hessian2Input;
27+
import com.caucho.hessian.io.Hessian2Output;
28+
import com.caucho.hessian.io.SerializerFactory;
29+
30+
public class EventMeshHessianSerializer extends HessianSerializer {
31+
32+
private SerializerFactory customizeSerializerFactory = new EventMeshSerializerFactory();
33+
34+
private static EventMeshHessianSerializer instance;
35+
36+
private EventMeshHessianSerializer() {
37+
}
38+
39+
public static HessianSerializer getInstance() {
40+
if (instance == null) {
41+
synchronized (EventMeshHessianSerializer.class) {
42+
if (instance == null) {
43+
instance = new EventMeshHessianSerializer();
44+
}
45+
}
46+
}
47+
return instance;
48+
}
49+
50+
@Override
51+
public byte[] serialize(Object obj) throws CodecException {
52+
ByteArrayOutputStream byteArray = new ByteArrayOutputStream();
53+
Hessian2Output output = new Hessian2Output(byteArray);
54+
output.setSerializerFactory(customizeSerializerFactory);
55+
try {
56+
output.writeObject(obj);
57+
output.close();
58+
} catch (IOException e) {
59+
throw new CodecException("IOException occurred when Hessian serializer encode!", e);
60+
}
61+
62+
return byteArray.toByteArray();
63+
}
64+
65+
@Override
66+
public <T> T deserialize(byte[] data, String classOfT) throws CodecException {
67+
Hessian2Input input = new Hessian2Input(new ByteArrayInputStream(data));
68+
input.setSerializerFactory(customizeSerializerFactory);
69+
Object resultObject;
70+
try {
71+
resultObject = input.readObject();
72+
input.close();
73+
} catch (IOException e) {
74+
throw new CodecException("IOException occurred when Hessian serializer decode!", e);
75+
}
76+
return (T) resultObject;
77+
}
78+
}

Diff for: ‎eventmesh-meta/eventmesh-meta-raft/src/main/java/org/apache/eventmesh/meta/raft/serialize/EventMeshSerializerFactory.java

+143
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,143 @@
1+
/*
2+
* Licensed to the Apache Software Foundation (ASF) under one or more
3+
* contributor license agreements. See the NOTICE file distributed with
4+
* this work for additional information regarding copyright ownership.
5+
* The ASF licenses this file to You under the Apache License, Version 2.0
6+
* (the "License"); you may not use this file except in compliance with
7+
* the License. You may obtain a copy of the License at
8+
*
9+
* http://www.apache.org/licenses/LICENSE-2.0
10+
*
11+
* Unless required by applicable law or agreed to in writing, software
12+
* distributed under the License is distributed on an "AS IS" BASIS,
13+
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
14+
* See the License for the specific language governing permissions and
15+
* limitations under the License.
16+
*/
17+
18+
package org.apache.eventmesh.meta.raft.serialize;
19+
20+
import java.text.SimpleDateFormat;
21+
import java.time.Instant;
22+
import java.time.LocalDate;
23+
import java.time.LocalDateTime;
24+
import java.time.LocalTime;
25+
import java.time.format.DateTimeFormatter;
26+
import java.util.ArrayList;
27+
import java.util.Calendar;
28+
import java.util.Date;
29+
import java.util.HashMap;
30+
import java.util.HashSet;
31+
import java.util.LinkedHashMap;
32+
import java.util.LinkedHashSet;
33+
import java.util.LinkedList;
34+
import java.util.List;
35+
import java.util.Map;
36+
import java.util.Set;
37+
import java.util.TreeMap;
38+
import java.util.TreeSet;
39+
import java.util.WeakHashMap;
40+
import java.util.concurrent.ConcurrentHashMap;
41+
import java.util.concurrent.ConcurrentMap;
42+
import java.util.concurrent.ConcurrentSkipListMap;
43+
import java.util.concurrent.CopyOnWriteArrayList;
44+
import java.util.concurrent.TimeUnit;
45+
import java.util.concurrent.atomic.AtomicBoolean;
46+
import java.util.concurrent.atomic.AtomicInteger;
47+
import java.util.concurrent.atomic.AtomicLong;
48+
import java.util.concurrent.atomic.AtomicReference;
49+
50+
import com.caucho.hessian.io.SerializerFactory;
51+
52+
public class EventMeshSerializerFactory extends SerializerFactory {
53+
EventMeshSerializerFactory() {
54+
super();
55+
super.getClassFactory().setWhitelist(true);
56+
allowBasicType();
57+
allowCollections();
58+
allowConcurrent();
59+
allowTime();
60+
super.getClassFactory().allow("org.apache.eventmesh.*");
61+
}
62+
63+
private void allowBasicType() {
64+
super.getClassFactory().allow(boolean.class.getCanonicalName());
65+
super.getClassFactory().allow(byte.class.getCanonicalName());
66+
super.getClassFactory().allow(char.class.getCanonicalName());
67+
super.getClassFactory().allow(double.class.getCanonicalName());
68+
super.getClassFactory().allow(float.class.getCanonicalName());
69+
super.getClassFactory().allow(int.class.getCanonicalName());
70+
super.getClassFactory().allow(long.class.getCanonicalName());
71+
super.getClassFactory().allow(short.class.getCanonicalName());
72+
super.getClassFactory().allow(Boolean.class.getCanonicalName());
73+
super.getClassFactory().allow(Byte.class.getCanonicalName());
74+
super.getClassFactory().allow(Character.class.getCanonicalName());
75+
super.getClassFactory().allow(Double.class.getCanonicalName());
76+
super.getClassFactory().allow(Float.class.getCanonicalName());
77+
super.getClassFactory().allow(Integer.class.getCanonicalName());
78+
super.getClassFactory().allow(Long.class.getCanonicalName());
79+
super.getClassFactory().allow(Short.class.getCanonicalName());
80+
81+
super.getClassFactory().allow(Number.class.getCanonicalName());
82+
super.getClassFactory().allow(Class.class.getCanonicalName());
83+
super.getClassFactory().allow(String.class.getCanonicalName());
84+
}
85+
86+
private void allowCollections() {
87+
super.getClassFactory().allow(List.class.getCanonicalName());
88+
super.getClassFactory().allow(ArrayList.class.getCanonicalName());
89+
super.getClassFactory().allow(LinkedList.class.getCanonicalName());
90+
91+
super.getClassFactory().allow(Set.class.getCanonicalName());
92+
super.getClassFactory().allow(HashSet.class.getCanonicalName());
93+
super.getClassFactory().allow(LinkedHashSet.class.getCanonicalName());
94+
super.getClassFactory().allow(TreeSet.class.getCanonicalName());
95+
96+
super.getClassFactory().allow(Map.class.getCanonicalName());
97+
super.getClassFactory().allow(HashMap.class.getCanonicalName());
98+
super.getClassFactory().allow(LinkedHashMap.class.getCanonicalName());
99+
super.getClassFactory().allow(TreeMap.class.getCanonicalName());
100+
super.getClassFactory().allow(WeakHashMap.class.getCanonicalName());
101+
102+
super.getClassFactory().allow("java.util.Arrays$ArrayList");
103+
super.getClassFactory().allow("java.util.Collections$EmptyList");
104+
super.getClassFactory().allow("java.util.Collections$EmptyMap");
105+
super.getClassFactory().allow("java.util.Collections$SingletonSet");
106+
super.getClassFactory().allow("java.util.Collections$SingletonList");
107+
super.getClassFactory().allow("java.util.Collections$UnmodifiableCollection");
108+
super.getClassFactory().allow("java.util.Collections$UnmodifiableList");
109+
super.getClassFactory().allow("java.util.Collections$UnmodifiableMap");
110+
super.getClassFactory().allow("java.util.Collections$UnmodifiableNavigableMap");
111+
super.getClassFactory().allow("java.util.Collections$UnmodifiableNavigableSet");
112+
super.getClassFactory().allow("java.util.Collections$UnmodifiableRandomAccessList");
113+
super.getClassFactory().allow("java.util.Collections$UnmodifiableSet");
114+
super.getClassFactory().allow("java.util.Collections$UnmodifiableSortedMap");
115+
super.getClassFactory().allow("java.util.Collections$UnmodifiableSortedSet");
116+
}
117+
118+
private void allowConcurrent() {
119+
super.getClassFactory().allow(AtomicBoolean.class.getCanonicalName());
120+
super.getClassFactory().allow(AtomicInteger.class.getCanonicalName());
121+
super.getClassFactory().allow(AtomicLong.class.getCanonicalName());
122+
super.getClassFactory().allow(AtomicReference.class.getCanonicalName());
123+
124+
super.getClassFactory().allow(ConcurrentMap.class.getCanonicalName());
125+
super.getClassFactory().allow(ConcurrentHashMap.class.getCanonicalName());
126+
super.getClassFactory().allow(ConcurrentSkipListMap.class.getCanonicalName());
127+
super.getClassFactory().allow(CopyOnWriteArrayList.class.getCanonicalName());
128+
}
129+
130+
private void allowTime() {
131+
super.getClassFactory().allow(SimpleDateFormat.class.getCanonicalName());
132+
super.getClassFactory().allow(DateTimeFormatter.class.getCanonicalName());
133+
super.getClassFactory().allow(Instant.class.getCanonicalName());
134+
super.getClassFactory().allow(LocalDate.class.getCanonicalName());
135+
super.getClassFactory().allow(LocalDateTime.class.getCanonicalName());
136+
super.getClassFactory().allow(LocalTime.class.getCanonicalName());
137+
super.getClassFactory().allow(TimeUnit.class.getCanonicalName());
138+
super.getClassFactory().allow(Date.class.getCanonicalName());
139+
super.getClassFactory().allow(Calendar.class.getCanonicalName());
140+
}
141+
142+
143+
}

0 commit comments

Comments
 (0)