Repository navigation
Conversation
…ut in provider form (higress-group#732) Signed-off-by: Rand01ph <tanyawei1991@gmail.com> Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
…reload (higress-group#749) Signed-off-by: ShadowSmallBaby <43118517+ShadowSmallBaby@users.noreply.github.com>
- Bump <fastjson.version> from 1.2.83 to 1.2.83_noneautotype. - 1.2.83_noneautotype is an Alibaba-published variant of 1.2.83 that replaces ParserConfig.checkAutoType with a blanket throw, eliminating the historical fastjson RCE gadgets by construction rather than by configuration. - Add FastjsonAutotypeGuardTest to lock the protection in CI: any future downgrade to a fastjson build that re-enables autoType will fail this test. Note on the test: @type=java.util.Date is used as the probe because HashMap and LinkedHashMap are handled by a hardcoded branch in DefaultJSONParser that runs BEFORE checkAutoType and is not modified by _noneautotype. Date is a basic JDK class that is not in the hardcoded branch, not in fastjson's deny list, and has a no-arg constructor, so it exercises the checkAutoType path. In 1.2.83, the test fails because the exception message is "syntax error" (checkAutoType allows Date, instance is created via reflection, then setting the unknown "foo" property fails). In 1.2.83_noneautotype, the test passes because checkAutoType throws "safeMode not support autoType : java.util.Date" -- the message contains "autoType" which the test asserts.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
将
com.alibaba:fastjson由1.2.83升级到1.2.83_noneautotype，从字节码层拆除@type/autoType 反序列化代码路径，消除历史 fastjson RCE gadget chains。Changes
backend/pom.xml:60—<fastjson.version>从1.2.83改为1.2.83_noneautotypebackend/console/src/test/java/com/alibaba/higress/console/security/FastjsonAutotypeGuardTest.java— 新增回归单测Why 1.2.83_noneautotype
1.2.83_noneautotype是阿里在 Maven Central 发布的同源代码、构建期剥离 autoType 处理的官方变体（com.alibaba:fastjson:1.2.83_noneautotype，Apache 2.0）。它把ParserConfig.checkAutoType整段替换为throw new JSONException("safeMode not support autoType : " + typeName)，比ParserConfig.safeMode = true更彻底——即使代码中显式使用ParserConfig也无路径可走。API 类（
com.alibaba.fastjson.JSON、JSONObject、JSONArray）入口与 1.2.83 完全一致；序列化路径（toJSONString）不受影响。所有 DAO/Service 调用点不调整。Test Plan
./mvnw -pl console -am test -Dmaven.gitcommitid.skip=true— console 2/2 pass (新守卫测试)./mvnw -pl sdk -am test -Dmaven.gitcommitid.skip=true— sdk 252/252 pass (无回归)