[dubbo] branch 3.1 updated: add switch to no use (#10504)

[albumenj]

This is an automated email from the ASF dual-hosted git repository.

albumenj pushed a commit to branch 3.1
in repository https://gitbox.apache.org/repos/asf/dubbo.git


The following commit(s) were added to refs/heads/3.1 by this push:
     new 752714863b add switch to no use (#10504)
752714863b is described below

commit 752714863b516195f8858583f89b35a4494a3ba8
Author: Owen.Cai <89424...@qq.com>
AuthorDate: Sat Aug 27 09:38:21 2022 +0800

    add switch to no use (#10504)
---
 .../apache/dubbo/common/constants/CommonConstants.java  |  2 ++
 .../dubbo/common/utils/SerializeClassChecker.java       | 17 ++++++++++++++---
 2 files changed, 16 insertions(+), 3 deletions(-)

diff --git 
a/dubbo-common/src/main/java/org/apache/dubbo/common/constants/CommonConstants.java
 
b/dubbo-common/src/main/java/org/apache/dubbo/common/constants/CommonConstants.java
index a238e7d439..eb8643cb2b 100644
--- 
a/dubbo-common/src/main/java/org/apache/dubbo/common/constants/CommonConstants.java
+++ 
b/dubbo-common/src/main/java/org/apache/dubbo/common/constants/CommonConstants.java
@@ -438,6 +438,8 @@ public interface CommonConstants {
 
     String DEFAULT_VERSION = "0.0.0";
 
+    String CLASS_DESERIALIZE_OPEN_CHECK = 
"dubbo.security.serialize.openCheckClass";
+
     String ROUTER_KEY = "router";
 
     String EXPORT_ASYNC_KEY = "export-async";
diff --git 
a/dubbo-common/src/main/java/org/apache/dubbo/common/utils/SerializeClassChecker.java
 
b/dubbo-common/src/main/java/org/apache/dubbo/common/utils/SerializeClassChecker.java
index cb5c2f04cc..50ddfdcfc3 100644
--- 
a/dubbo-common/src/main/java/org/apache/dubbo/common/utils/SerializeClassChecker.java
+++ 
b/dubbo-common/src/main/java/org/apache/dubbo/common/utils/SerializeClassChecker.java
@@ -17,6 +17,8 @@
 package org.apache.dubbo.common.utils;
 
 import org.apache.dubbo.common.beanutil.JavaBeanSerializeUtil;
+import org.apache.dubbo.common.config.ConfigurationUtils;
+import org.apache.dubbo.common.constants.CommonConstants;
 import org.apache.dubbo.common.logger.Logger;
 import org.apache.dubbo.common.logger.LoggerFactory;
 
@@ -36,6 +38,7 @@ public class SerializeClassChecker {
 
     private static volatile SerializeClassChecker INSTANCE = null;
 
+    private final boolean OPEN_CHECK_CLASS;
     private final boolean BLOCK_ALL_CLASS_EXCEPT_ALLOW;
     private final Set<String> CLASS_DESERIALIZE_ALLOWED_SET = new 
ConcurrentHashSet<>();
     private final Set<String> CLASS_DESERIALIZE_BLOCKED_SET = new 
ConcurrentHashSet<>();
@@ -47,7 +50,11 @@ public class SerializeClassChecker {
     private final AtomicLong counter = new AtomicLong(0);
 
     private SerializeClassChecker() {
-        String blockAllClassExceptAllow = 
System.getProperty(CLASS_DESERIALIZE_BLOCK_ALL, "false");
+        String openCheckClass = 
ConfigurationUtils.getProperty(CommonConstants.CLASS_DESERIALIZE_OPEN_CHECK, 
"true");
+        OPEN_CHECK_CLASS = Boolean.parseBoolean(openCheckClass);
+
+        String blockAllClassExceptAllow = 
ConfigurationUtils.getProperty(CLASS_DESERIALIZE_BLOCK_ALL, "false");
+        
         BLOCK_ALL_CLASS_EXCEPT_ALLOW = 
Boolean.parseBoolean(blockAllClassExceptAllow);
 
         String[] lines;
@@ -70,8 +77,8 @@ public class SerializeClassChecker {
             logger.error("Failed to load blocked class list! Will ignore 
default blocked list.", e);
         }
 
-        String allowedClassList = 
System.getProperty(CLASS_DESERIALIZE_ALLOWED_LIST, 
"").trim().toLowerCase(Locale.ROOT);
-        String blockedClassList = 
System.getProperty(CLASS_DESERIALIZE_BLOCKED_LIST, 
"").trim().toLowerCase(Locale.ROOT);
+        String allowedClassList = 
ConfigurationUtils.getProperty(CLASS_DESERIALIZE_ALLOWED_LIST, 
"").trim().toLowerCase(Locale.ROOT);
+        String blockedClassList = 
ConfigurationUtils.getProperty(CLASS_DESERIALIZE_BLOCKED_LIST, 
"").trim().toLowerCase(Locale.ROOT);
 
         if (StringUtils.isNotEmpty(allowedClassList)) {
             String[] classStrings = allowedClassList.trim().split(",");
@@ -111,6 +118,10 @@ public class SerializeClassChecker {
      * @param name class name ( all are convert to lower case )
      */
     public void validateClass(String name) {
+        if(!OPEN_CHECK_CLASS){
+            return;
+        }
+
         name = name.toLowerCase(Locale.ROOT);
         if (CACHE == CLASS_ALLOW_LFU_CACHE.get(name)) {
             return;