-
Notifications
You must be signed in to change notification settings - Fork 189
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
feat: 漏洞检测-新增QLExpress表达式注入检测时判断安全配置是否开启 #596
Conversation
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
卸载时把 QLExpressCheck.setQLClassLoader 置空,如果loader还在那么这个引用还在,会导致该类卸载不掉
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
如果不是用SetQLClassLoader 直接使用Class.forName 会存在该情况吗
我看FastJSONCheck也没有做这些处理
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
如果不是用SetQLClassLoader 直接使用Class.forName 会存在该情况吗 我看FastJSONCheck也没有做这些处理
底层原理是:类成员变量尽量不要引用被插桩程序对象,若必须引用情况的下,要在卸载时将其置空取消引用。类成员变量随着对象的建立而建立,随着对象的消失而消失,存在于对象所在的堆内存中,所以如果不把其置为空,单卸载iastclassloader是没办法将该引用取消的。
Class.forName 也分情况,若有对被插桩应用的引用,就会存在这种情况。
FastJSONCheck 同样需要置空
return true; | ||
} | ||
}catch (Throwable e){ | ||
DongTaiLog.debug("Beim Abrufen der Felder der QLExpress-Komponente ist ein Fehler aufgetreten.: {}, {}", |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
哥,这是德文不是英文啊 @UzJu
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
。。。后面的commit改了
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
:)
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
笑死我了
No description provided.