diff --git a/core/src/main/java/com/alibaba/fastjson2/filter/ContextAutoTypeBeforeHandler.java b/core/src/main/java/com/alibaba/fastjson2/filter/ContextAutoTypeBeforeHandler.java index 59d7979e11b9251dd00b85f33e558b2d4488af5c..22783662a6fdc8692b8de2141098ed5e7e319e77 100644 --- a/core/src/main/java/com/alibaba/fastjson2/filter/ContextAutoTypeBeforeHandler.java +++ b/core/src/main/java/com/alibaba/fastjson2/filter/ContextAutoTypeBeforeHandler.java @@ -24,6 +24,7 @@ import static com.alibaba.fastjson2.util.TypeUtils.*; public class ContextAutoTypeBeforeHandler implements JSONReader.AutoTypeBeforeHandler { final long[] acceptHashCodes; + final Set acceptNameSet; final ConcurrentMap> tclHashCaches = new ConcurrentHashMap<>(); final Map classCache = new ConcurrentHashMap<>(16, 0.75f, 1); @@ -206,6 +207,7 @@ public class ContextAutoTypeBeforeHandler } long[] array = new long[nameSet.size()]; + Set normalizedNames = new HashSet<>(nameSet.size()); int index = 0; for (String name : nameSet) { @@ -220,6 +222,7 @@ public class ContextAutoTypeBeforeHandler } array[index++] = hashCode; + normalizedNames.add(name.replace('$', '.')); } if (index != array.length) { @@ -227,6 +230,7 @@ public class ContextAutoTypeBeforeHandler } Arrays.sort(array); this.acceptHashCodes = array; + this.acceptNameSet = Collections.unmodifiableSet(normalizedNames); } public Class apply(long typeNameHash, Class expectClass, long features) { @@ -248,6 +252,10 @@ public class ContextAutoTypeBeforeHandler typeName = "Object"; } + if (typeName.indexOf(':') >= 0 || typeName.indexOf('!') >= 0) { + return null; + } + long hash = MAGIC_HASH_CODE; for (int i = 0, typeNameLength = typeName.length(); i < typeNameLength; ++i) { char ch = typeName.charAt(i); @@ -258,6 +266,10 @@ public class ContextAutoTypeBeforeHandler hash *= MAGIC_PRIME; if (Arrays.binarySearch(acceptHashCodes, hash) >= 0) { + String prefix = typeName.substring(0, i + 1).replace('$', '.'); + if (!acceptNameSet.contains(prefix)) { + continue; + } long typeNameHash = Fnv.hashCode64(typeName); Class clazz = apply(typeNameHash, expectClass, features); diff --git a/core/src/main/java/com/alibaba/fastjson2/reader/ObjectReaderProvider.java b/core/src/main/java/com/alibaba/fastjson2/reader/ObjectReaderProvider.java index 2575b274d958d677e5dc86a477f5bbbd8b491931..9cd3d3e46e6ff55f0a27f0dbe1511cace7002095 100644 --- a/core/src/main/java/com/alibaba/fastjson2/reader/ObjectReaderProvider.java +++ b/core/src/main/java/com/alibaba/fastjson2/reader/ObjectReaderProvider.java @@ -197,6 +197,7 @@ public class ObjectReaderProvider boolean disableSmartMatch = JSONFactory.isDisableSmartMatch(); private volatile long[] acceptHashCodes; + private volatile Set acceptNameSet = Collections.emptySet(); private AutoTypeBeforeHandler autoTypeBeforeHandler = DEFAULT_AUTO_TYPE_BEFORE_HANDLER; private Consumer autoTypeHandler = DEFAULT_AUTO_TYPE_HANDLER; @@ -204,12 +205,15 @@ public class ObjectReaderProvider { long[] hashCodes; + Set names = new HashSet<>(); if (AUTO_TYPE_ACCEPT_LIST == null) { hashCodes = new long[1]; } else { hashCodes = new long[AUTO_TYPE_ACCEPT_LIST.length + 1]; for (int i = 0; i < AUTO_TYPE_ACCEPT_LIST.length; i++) { + String name = AUTO_TYPE_ACCEPT_LIST[i].replace('$', '.'); hashCodes[i] = Fnv.hashCode64(AUTO_TYPE_ACCEPT_LIST[i]); + names.add(name); } } @@ -217,6 +221,7 @@ public class ObjectReaderProvider Arrays.sort(hashCodes); acceptHashCodes = hashCodes; + acceptNameSet = Collections.unmodifiableSet(names); hashCache.put(ObjectArrayReader.TYPE_HASH_CODE, ObjectArrayReader.INSTANCE); final long STRING_CLASS_NAME_HASH = -4834614249632438472L; // Fnv.hashCode64(String.class.getName()); @@ -264,6 +269,9 @@ public class ObjectReaderProvider Arrays.sort(hashCodes); this.acceptHashCodes = hashCodes; } + Set names = new HashSet<>(this.acceptNameSet); + names.add(name.replace('$', '.')); + this.acceptNameSet = Collections.unmodifiableSet(names); } } @@ -809,6 +817,10 @@ public class ObjectReaderProvider throw new JSONException("autoType is not support. " + typeName); } + if (typeName.indexOf(':') >= 0 || typeName.indexOf('!') >= 0) { + throw new JSONException("autoType is not support. " + typeName); + } + if (typeName.charAt(0) == '[') { String componentTypeName = typeName.substring(1); checkAutoType(componentTypeName, null, features); // blacklist check for componentType @@ -832,6 +844,10 @@ public class ObjectReaderProvider hash ^= ch; hash *= MAGIC_PRIME; if (Arrays.binarySearch(acceptHashCodes, hash) >= 0) { + String prefix = typeName.substring(0, i + 1).replace('$', '.'); + if (!acceptNameSet.contains(prefix)) { + continue; + } clazz = loadClass(typeName); if (clazz != null) { if (expectClass != null && !expectClass.isAssignableFrom(clazz)) { @@ -857,8 +873,18 @@ public class ObjectReaderProvider // white list if (Arrays.binarySearch(acceptHashCodes, hash) >= 0) { + String prefix = typeName.substring(0, i + 1).replace('$', '.'); + if (!acceptNameSet.contains(prefix)) { + continue; + } clazz = loadClass(typeName); + if (clazz != null) { + if (ClassLoader.class.isAssignableFrom(clazz) || JDKUtils.isSQLDataSourceOrRowSet(clazz)) { + throw new JSONException("autoType is not support. " + typeName); + } + } + if (clazz != null && expectClass != null && !expectClass.isAssignableFrom(clazz)) { throw new JSONException("type not match. " + typeName + " -> " + expectClass.getName()); } diff --git a/core/src/main/java/com/alibaba/fastjson2/util/TypeUtils.java b/core/src/main/java/com/alibaba/fastjson2/util/TypeUtils.java index 1536a79dedf6a29842987628e2b1721241681e91..0ca667fa0e94432ae0cd716229962a30a40779c8 100644 --- a/core/src/main/java/com/alibaba/fastjson2/util/TypeUtils.java +++ b/core/src/main/java/com/alibaba/fastjson2/util/TypeUtils.java @@ -2832,6 +2832,10 @@ public class TypeUtils { return null; } + if (className.indexOf(':') >= 0 || className.indexOf('!') >= 0) { + return null; + } + switch (className) { case "O": case "Object": diff --git a/core/src/test/java/com/alibaba/fastjson2/autoType/AutoTypeValidationTest.java b/core/src/test/java/com/alibaba/fastjson2/autoType/AutoTypeValidationTest.java new file mode 100644 index 0000000000000000000000000000000000000000..2529054f8c779a05668104d40517eb03a1a6c313 --- /dev/null +++ b/core/src/test/java/com/alibaba/fastjson2/autoType/AutoTypeValidationTest.java @@ -0,0 +1,118 @@ +package com.alibaba.fastjson2.autoType; + +import com.alibaba.fastjson2.JSON; +import com.alibaba.fastjson2.JSONException; +import com.alibaba.fastjson2.JSONReader; +import com.alibaba.fastjson2.filter.ContextAutoTypeBeforeHandler; +import com.alibaba.fastjson2.reader.ObjectReaderProvider; +import com.alibaba.fastjson2.util.TypeUtils; +import org.junit.jupiter.api.Tag; +import org.junit.jupiter.api.Test; + +import static org.junit.jupiter.api.Assertions.*; + +@Tag("autotype") +public class AutoTypeValidationTest { + @Test + public void testRejectColonInTypeName() { + ObjectReaderProvider provider = new ObjectReaderProvider(); + assertThrows(JSONException.class, () -> + provider.checkAutoType("com.example.Bean:invalid", null, 0)); + } + + @Test + public void testRejectExclamationInTypeName() { + ObjectReaderProvider provider = new ObjectReaderProvider(); + assertThrows(JSONException.class, () -> + provider.checkAutoType("com.example.Bean!invalid", null, 0)); + } + + @Test + public void testRejectColonWithSupportAutoType() { + ObjectReaderProvider provider = new ObjectReaderProvider(); + long features = JSONReader.Feature.SupportAutoType.mask; + assertThrows(JSONException.class, () -> + provider.checkAutoType("com.example.Bean:invalid", null, features)); + } + + @Test + public void testLoadClassRejectsColon() { + assertNull(TypeUtils.loadClass("com.example.Bean:invalid")); + } + + @Test + public void testLoadClassRejectsExclamation() { + assertNull(TypeUtils.loadClass("com.example.Bean!invalid")); + } + + @Test + public void testLoadClassNormalClass() { + assertEquals(String.class, TypeUtils.loadClass("java.lang.String")); + } + + @Test + public void testContextHandlerRejectsColon() { + ContextAutoTypeBeforeHandler handler = new ContextAutoTypeBeforeHandler(true); + assertNull(handler.apply("com.example.Bean:invalid", null, 0)); + } + + @Test + public void testContextHandlerRejectsExclamation() { + ContextAutoTypeBeforeHandler handler = new ContextAutoTypeBeforeHandler(true); + assertNull(handler.apply("com.example.Bean!invalid", null, 0)); + } + + @Test + public void testContextHandlerAcceptsWhitelisted() { + ContextAutoTypeBeforeHandler handler = new ContextAutoTypeBeforeHandler(String.class); + Class clazz = handler.apply("java.lang.String", null, 0); + assertEquals(String.class, clazz); + } + + @Test + public void testContextHandlerRejectsNonWhitelisted() { + ContextAutoTypeBeforeHandler handler = new ContextAutoTypeBeforeHandler(String.class); + assertNull(handler.apply("com.example.NotWhitelisted", null, 0)); + } + + @Test + public void testWhitelistWithAddAccept() { + ObjectReaderProvider provider = new ObjectReaderProvider(); + provider.addAutoTypeAccept("com.alibaba.fastjson2.autoType.AutoTypeValidationTest$"); + + long features = JSONReader.Feature.SupportAutoType.mask; + Class clazz = provider.checkAutoType( + "com.alibaba.fastjson2.autoType.AutoTypeValidationTest$TestBean", null, features); + assertEquals(TestBean.class, clazz); + } + + @Test + public void testWhitelistTextVerification() { + ObjectReaderProvider provider = new ObjectReaderProvider(); + provider.addAutoTypeAccept("com.example."); + + long features = JSONReader.Feature.SupportAutoType.mask; + Class clazz = provider.checkAutoType("com.other.NotAccepted", null, features); + assertNull(clazz); + } + + @Test + public void testParseWithAutoTypeFilterRejectsColon() { + String json = "{\"@type\":\"com.example.Bean:invalid\",\"value\":1}"; + assertThrows(JSONException.class, () -> + JSON.parseObject(json, Object.class, + JSONReader.autoTypeFilter(String.class))); + } + + @Test + public void testParseWithAutoTypeFilterNormal() { + String json = "{\"@type\":\"java.util.HashMap\",\"value\":1}"; + Object obj = JSON.parseObject(json, Object.class, + JSONReader.autoTypeFilter("java.util.HashMap")); + assertNotNull(obj); + } + + public static class TestBean { + public int id; + } +}