[dubbo-hessian-lite] branch master updated: Deny in deserialize

[albumenj]

This is an automated email from the ASF dual-hosted git repository.

albumenj pushed a commit to branch master
in repository https://gitbox.apache.org/repos/asf/dubbo-hessian-lite.git


The following commit(s) were added to refs/heads/master by this push:
     new 99d689cf Deny in deserialize
     new b0486722 Merge pull request #58 from AlbumenJ/0827_deny_non
99d689cf is described below

commit 99d689cf47c00b664db89bc8dff44dcd595b6ea6
Author: Albumen Kevin <jhq0...@gmail.com>
AuthorDate: Sat Aug 27 10:09:29 2022 +0800

    Deny in deserialize
---
 .../com/caucho/hessian/io/SerializerFactory.java   | 15 +++++++++-----
 .../com/caucho/hessian/io/DenyListTest.java        |  1 -
 .../caucho/hessian/io/SerializerFactoryTest.java   | 23 ++++++++++++++++++++++
 3 files changed, 33 insertions(+), 6 deletions(-)

diff --git 
a/src/main/java/com/alibaba/com/caucho/hessian/io/SerializerFactory.java 
b/src/main/java/com/alibaba/com/caucho/hessian/io/SerializerFactory.java
index 00fe94d0..4be4d0b3 100644
--- a/src/main/java/com/alibaba/com/caucho/hessian/io/SerializerFactory.java
+++ b/src/main/java/com/alibaba/com/caucho/hessian/io/SerializerFactory.java
@@ -343,6 +343,11 @@ public class SerializerFactory extends 
AbstractSerializerFactory {
             serializer = factory.getSerializer(cl);
         }
 
+        if (!Serializable.class.isAssignableFrom(cl)
+                && !_isAllowNonSerializable) {
+            throw new IllegalStateException("Serialized class " + cl.getName() 
+ " must implement java.io.Serializable");
+        }
+
         if (serializer != null) {
 
         } else if (isZoneId(cl)) //must before "else if 
(JavaSerializer.getWriteReplace(cl) != null)"
@@ -414,11 +419,6 @@ public class SerializerFactory extends 
AbstractSerializerFactory {
         if (_defaultSerializer != null)
             return _defaultSerializer;
 
-        if (!Serializable.class.isAssignableFrom(cl)
-                && !_isAllowNonSerializable) {
-            throw new IllegalStateException("Serialized class " + cl.getName() 
+ " must implement java.io.Serializable");
-        }
-
         return new JavaSerializer(cl, _loader);
     }
 
@@ -453,6 +453,11 @@ public class SerializerFactory extends 
AbstractSerializerFactory {
             deserializer = factory.getDeserializer(cl);
         }
 
+        if (!Serializable.class.isAssignableFrom(cl)
+                && !_isAllowNonSerializable) {
+            throw new IllegalStateException("Serialized class " + cl.getName() 
+ " must implement java.io.Serializable");
+        }
+
         if (deserializer != null) {
         } else if (Collection.class.isAssignableFrom(cl))
             deserializer = new CollectionDeserializer(cl);
diff --git a/src/test/java/com/alibaba/com/caucho/hessian/io/DenyListTest.java 
b/src/test/java/com/alibaba/com/caucho/hessian/io/DenyListTest.java
index 3c8375df..64578a63 100644
--- a/src/test/java/com/alibaba/com/caucho/hessian/io/DenyListTest.java
+++ b/src/test/java/com/alibaba/com/caucho/hessian/io/DenyListTest.java
@@ -18,7 +18,6 @@ package com.alibaba.com.caucho.hessian.io;
 
 import org.junit.Assert;
 import org.junit.Test;
-import sun.rmi.transport.StreamRemoteCall;
 
 import java.lang.reflect.Array;
 import java.util.HashMap;
diff --git 
a/src/test/java/com/alibaba/com/caucho/hessian/io/SerializerFactoryTest.java 
b/src/test/java/com/alibaba/com/caucho/hessian/io/SerializerFactoryTest.java
index 36b32c51..57999aba 100644
--- a/src/test/java/com/alibaba/com/caucho/hessian/io/SerializerFactoryTest.java
+++ b/src/test/java/com/alibaba/com/caucho/hessian/io/SerializerFactoryTest.java
@@ -73,6 +73,29 @@ public class SerializerFactoryTest {
         Assert.assertTrue("several Deserializer!", d1 == d2);
     }
 
+    @Test
+    public void testCheckSerializable() throws HessianProtocolException {
+        final SerializerFactory serializerFactory = new SerializerFactory();
+        try {
+            serializerFactory.getSerializer(TestImpl.class);
+            Assert.fail();
+        } catch (RuntimeException e) {
+            Assert.assertEquals(IllegalStateException.class, e.getClass());
+            Assert.assertTrue(e.getMessage().equals("Serialized class 
com.alibaba.com.caucho.hessian.io.TestImpl must implement 
java.io.Serializable"));
+        }
+
+        try {
+            serializerFactory.getDeserializer(TestImpl.class);
+            Assert.fail();
+        } catch (RuntimeException e) {
+            Assert.assertEquals(IllegalStateException.class, e.getClass());
+            Assert.assertTrue(e.getMessage().startsWith("Serialized class 
com.alibaba.com.caucho.hessian.io.TestImpl must implement 
java.io.Serializable"));
+        }
+
+        Assert.assertNotNull(serializerFactory.getSerializer(TestClass.class));
+        
Assert.assertNotNull(serializerFactory.getDeserializer(TestClass.class));
+    }
+
     @Test
     public void getDeserializerDuplicateThread() throws Exception {
         final SerializerFactory serializerFactory = new SerializerFactory();