Skip to content

fastjson 2.0.63版本发布

Latest
Latest

Choose a tag to compare

View all tags
@wenshao wenshao released this 29 Jul 08:22
2.0.63
82eda3e
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

FASTJSON 2.0.63 Release Notes

Release Date: 29 Jul 2026
Tag: 2.0.63 (82eda3e)

Overview

This is a security fix release. It hardens AutoType deserialization and fixes several parser robustness issues (OOM / DoS) that can be triggered by crafted input. All users are strongly recommended to upgrade, especially applications parsing untrusted JSON or JSONB data.

Users who cannot upgrade immediately can mitigate the AutoType issue with -Dfastjson2.parser.safeMode=true (applications not using a custom AutoTypeBeforeHandler).

fastjson 1.x users: the same AutoType hardening is available in fastjson 1.2.84.

Security Fixes

  1. Strengthened AutoType type name validation and whitelist verification: type names containing URL-special characters are rejected before reaching the class loader; the accept name text is verified after a whitelist hash match so a hash collision alone cannot whitelist a type; an accept prefix no longer covers ClassLoader/DataSource/RowSet gadget base types — only an accept entry naming the type in full is treated as an explicit opt-in #7703
  2. Limited number literal digits to prevent BigInteger O(n²) DoS with crafted long number literals #7668 #7694
  3. Fixed JSONB BC_BIGINT declared-length OOM from crafted payloads declaring a huge length #7669 #7696
  4. Fixed JSONB BC_BINARY declared-length OOM #7669 #7705

Changes & Bug Fixes

  1. Fixed missing reference detection for Collection elements (e.g. HashSet), duplicate elements now serialize as $ref when ReferenceDetection is on #7678 #7701
  2. Fixed Metaspace leak caused by ObjectWriter created in the switch block of getObjectWriterInternal #7626 #7627
  3. Fixed performance: hoisted getInt/setInt out of lambda to avoid per-call spin #7677 #7693
  4. Added support for JSONCompiled records #7665
  5. Added warning when a Kotlin class loses field values due to missing kotlin-reflect #7675

Maven Dependency Configuration

Standard Version

<dependency>
    <groupId>com.alibaba.fastjson2</groupId>
    <artifactId>fastjson2</artifactId>
    <version>2.0.63</version>
</dependency>

Android 5 Optimized Version

<dependency>
    <groupId>com.alibaba.fastjson2</groupId>
    <artifactId>fastjson2</artifactId>
    <version>2.0.63.android5</version>
</dependency>

Android 8 Optimized Version

<dependency>
    <groupId>com.alibaba.fastjson2</groupId>
    <artifactId>fastjson2</artifactId>
    <version>2.0.63.android8</version>
</dependency>
中文版本

概述

本版本为安全修复版本，加固了 AutoType 反序列化校验，并修复了多个可由构造输入触发的解析健壮性问题（OOM / DoS）。强烈建议所有用户升级，尤其是解析不可信 JSON 或 JSONB 数据的应用。

暂时无法升级的用户，可通过 -Dfastjson2.parser.safeMode=true 缓解 AutoType 问题（适用于未使用自定义 AutoTypeBeforeHandler 的应用）。

fastjson 1.x 用户：同款 AutoType 加固已在 fastjson 1.2.84 中提供。

安全修复

  1. 加强 AutoType 类型名校验与白名单验证：包含 URL 特殊字符的类型名在到达类加载器之前即被拒绝；白名单 hash 命中后增加文本回验，仅 hash 碰撞无法再绕过白名单；accept 前缀不再覆盖 ClassLoader/DataSource/RowSet 等危险基类——只有完整类名的 accept 条目才视为显式放行 #7703
  2. 限制数字字面量位数，防止构造的超长数字触发 BigInteger O(n²) DoS #7668 #7694
  3. 修复 JSONB BC_BIGINT 声明长度 OOM（构造超大长度声明的 payload）#7669 #7696
  4. 修复 JSONB BC_BINARY 声明长度 OOM #7669 #7705

变更与问题修复

  1. 修复 Collection 元素（如 HashSet）缺少引用检测的问题，开启 ReferenceDetection 时重复元素现在正确序列化为 $ref #7678 #7701
  2. 修复 getObjectWriterInternal switch 分支中创建的 ObjectWriter 未缓存导致的 Metaspace 泄漏 #7626 #7627
  3. 性能修复：将 getInt/setInt 移出 lambda，避免每次调用自旋 #7677 #7693
  4. 支持 JSONCompiled records #7665
  5. 缺少 kotlin-reflect 导致 Kotlin 类字段值丢失时增加警告日志 #7675

Maven 依赖配置

标准版本

<dependency>
    <groupId>com.alibaba.fastjson2</groupId>
    <artifactId>fastjson2</artifactId>
    <version>2.0.63</version>
</dependency>

Android 5 优化版本

<dependency>
    <groupId>com.alibaba.fastjson2</groupId>
    <artifactId>fastjson2</artifactId>
    <version>2.0.63.android5</version>
</dependency>

Android 8 优化版本

<dependency>
    <groupId>com.alibaba.fastjson2</groupId>
    <artifactId>fastjson2</artifactId>
    <version>2.0.63.android8</version>
</dependency>
Assets 2
Loading