[General][Dubbo] 序列化安全校验

[zonghaishang]

Pre-check

• I am sure that all the content I provide is in English.

Apache Dubbo Component

Java SDK (apache/dubbo)

Details

using dubbo path:

dubbo/dubbo-rpc/dubbo-rpc-dubbo/src/main/java/org/apache/dubbo/rpc/protocol/dubbo/DecodeableRpcInvocation.java

Line 146 in 3a30432

String keyWithoutGroup = keyWithoutGroup(path, version);

using dubbo interface:

dubbo/dubbo-rpc/dubbo-rpc-api/src/main/java/org/apache/dubbo/rpc/protocol/PermittedSerializationKeeper.java

Line 41 in 3a30432

Set<Byte> set = ConcurrentHashMapUtils.computeIfAbsent(

    public void registerService(URL url) {
        Set<Byte> set = ConcurrentHashMapUtils.computeIfAbsent(
                serviceToSerializationId, keyWithoutGroup(url.getServiceKey()), k -> new ConcurrentHashSet<>());
        Collection<String> serializations = UrlUtils.allSerializations(url);
        for (String serialization : serializations) {
            Byte id = CodecSupport.getIDByName(serialization);
            if (id != null) {
                set.add(id);
                globalPermittedSerializationIds.add(id);
            }
        }
    }

dubbo path may not same with interface, maybe throw exception:

        ClassLoader originClassLoader = Thread.currentThread().getContextClassLoader();
        try {
            if (CHECK_SERIALIZATION) {
                PermittedSerializationKeeper keeper =
                        frameworkModel.getBeanFactory().getBean(PermittedSerializationKeeper.class);
                if (!keeper.checkSerializationPermitted(keyWithoutGroup, serializationType)) {
                    throw new IOException("Unexpected serialization id:" + serializationType
                            + " received from network, please check if the peer send the right id.");
                }
            }

Code of Conduct

• I agree to follow this project's Code of Conduct

[zonghaishang]

@AlbumenJ please take a look