You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@dubbo.apache.org by gi...@apache.org on 2023/07/14 09:14:26 UTC
[dubbo-website] branch cn-site updated: deploy: fd0fd7611b4028418d83d2b5b080d6bc46853177
This is an automated email from the ASF dual-hosted git repository.
github-bot pushed a commit to branch cn-site
in repository https://gitbox.apache.org/repos/asf/dubbo-website.git
The following commit(s) were added to refs/heads/cn-site by this push:
new 57f764a402 deploy: fd0fd7611b4028418d83d2b5b080d6bc46853177
57f764a402 is described below
commit 57f764a40227b8fde6c04ad748dc28d3988f1e6d
Author: AlbumenJ <Al...@users.noreply.github.com>
AuthorDate: Fri Jul 14 09:14:20 2023 +0000
deploy: fd0fd7611b4028418d83d2b5b080d6bc46853177
---
sitemap.xml | 2 +-
.../advanced-features-and-usage/security/class-check/index.html | 6 +++---
.../java-sdk/advanced-features-and-usage/security/index.xml | 8 ++++----
zh-cn/sitemap.xml | 2 +-
4 files changed, 9 insertions(+), 9 deletions(-)
diff --git a/sitemap.xml b/sitemap.xml
index 8e22cf5355..f2d2ba4019 100644
--- a/sitemap.xml
+++ b/sitemap.xml
@@ -1 +1 @@
-<?xml version="1.0" encoding="utf-8" standalone="yes"?><sitemapindex xmlns="http://www.sitemaps.org/schemas/sitemap/0.9"><sitemap><loc>https://cn.dubbo.apache.org/zh-cn/sitemap.xml</loc><lastmod>2023-07-14T11:20:31+08:00</lastmod></sitemap><sitemap><loc>https://cn.dubbo.apache.org/en/sitemap.xml</loc><lastmod>2023-05-10T11:59:30+08:00</lastmod></sitemap></sitemapindex>
\ No newline at end of file
+<?xml version="1.0" encoding="utf-8" standalone="yes"?><sitemapindex xmlns="http://www.sitemaps.org/schemas/sitemap/0.9"><sitemap><loc>https://cn.dubbo.apache.org/zh-cn/sitemap.xml</loc><lastmod>2023-07-14T17:08:24+08:00</lastmod></sitemap><sitemap><loc>https://cn.dubbo.apache.org/en/sitemap.xml</loc><lastmod>2023-05-10T11:59:30+08:00</lastmod></sitemap></sitemapindex>
\ No newline at end of file
diff --git a/zh-cn/overview/mannual/java-sdk/advanced-features-and-usage/security/class-check/index.html b/zh-cn/overview/mannual/java-sdk/advanced-features-and-usage/security/class-check/index.html
index d5a9029584..3be7724b31 100644
--- a/zh-cn/overview/mannual/java-sdk/advanced-features-and-usage/security/class-check/index.html
+++ b/zh-cn/overview/mannual/java-sdk/advanced-features-and-usage/security/class-check/index.html
@@ -1,4 +1,4 @@
-<!doctype html><html lang=zh-cn class=no-js><head><meta name=ROBOTS content="INDEX, FOLLOW"><link rel=canonical href=https://cn.dubbo.apache.org/zh-cn/overview/mannual/java-sdk/advanced-features-and-usage/security/class-check/><script>var _hmt=_hmt||[];(function(){var e,t=document.createElement("script");t.src="https://hm.baidu.com/hm.js?3b78f49ba47181e4d998a66b689446e9",e=document.getElementsByTagName("script")[0],e.parentNode.insertBefore(t,e)})()</script><meta charset=utf-8><meta name [...]
+<!doctype html><html lang=zh-cn class=no-js><head><meta name=ROBOTS content="INDEX, FOLLOW"><link rel=canonical href=https://cn.dubbo.apache.org/zh-cn/overview/mannual/java-sdk/advanced-features-and-usage/security/class-check/><script>var _hmt=_hmt||[];(function(){var e,t=document.createElement("script");t.src="https://hm.baidu.com/hm.js?3b78f49ba47181e4d998a66b689446e9",e=document.getElementsByTagName("script")[0],e.parentNode.insertBefore(t,e)})()</script><meta charset=utf-8><meta name [...]
<script>var doNotTrack=!1;if(!doNotTrack){window.dataLayer=window.dataLayer||[];function gtag(){dataLayer.push(arguments)}gtag("js",new Date),gtag("config","G-NM6FFMT51J",{anonymize_ip:!1})}</script><link rel=preload href=/scss/main.min.fe7176cbe3102a33d3e8c0c9cec61eb52508abd24a2cc1ae23ccf535a481ffde.css as=style><link href=/scss/main.min.fe7176cbe3102a33d3e8c0c9cec61eb52508abd24a2cc1ae23ccf535a481ffde.css rel=stylesheet integrity><script src=/js/jquery-3.5.1.min.js integrity="sha256-9/a [...]
<link rel=stylesheet href=https://cdn.jsdelivr.net/npm/@docsearch/css@3><meta name=theme-color content="#326ce5"><link rel=stylesheet href=/css/feature-states.css><meta name=description content="了解 Dubbo 类检查机制"><meta property="og:description" content="了解 Dubbo 类检查机制"><meta name=twitter:description content="了解 Dubbo 类检查机制"><meta property="og:url" content="https://cn.dubbo.apache.org/zh-cn/overview/mannual/java-sdk/advanced-features-and-usage/security/class-check/"><meta property="og:title [...]
<link href=/css/community.css rel=stylesheet><link href=/css/contactus.css rel=stylesheet><link href=/css/language.css rel=stylesheet><script src=/js/script.js></script></head><body class="td-page td-documentation"><header><nav class="js-navbar-scroll navbar navbar-expand navbar-dark flex-column flex-md-row td-navbar" data-auto-burger=primary><a class=navbar-brand href=/zh-cn/><span class=navbar-logo></span><span class="text-uppercase font-weight-bold">Apache Dubbo</span></a><div class=" [...]
@@ -690,7 +690,7 @@ Dubbo >= 3.1.6</p><p>适用范围
</span></span></code></pre></div><p>通过 System Property 配置：</p><div class=highlight><pre tabindex=0 style=color:#93a1a1;background-color:#002b36;-moz-tab-size:4;-o-tab-size:4;tab-size:4><code class=language-properties data-lang=properties><span style=display:flex><span>-Ddubbo.application.check-serializable<span style=color:#719e07>=</span><span style=color:#2aa198>true</span>
</span></span></code></pre></div><p>配置成功后可以在日志中看到如下的提示：</p><div class=highlight><pre tabindex=0 style=color:#93a1a1;background-color:#002b36;-moz-tab-size:4;-o-tab-size:4;tab-size:4><code class=language-fallback data-lang=fallback><span style=display:flex><span>INFO utils.SerializeSecurityManager: [DUBBO] Serialize check serializable: true
</span></span></code></pre></div><p>注 1：在同一个进程（Dubbo Framework Model）下的多个应用如果同时配置不同的 Serializable 接口检查模式，最终会生效“最宽松”的级别。如两个 Spring Context 同时启动，一个配置为 <code>true</code>，另外一个配置为 <code>false</code>，则最终生效 <code>false</code> 级别的配置。
-注 2：目前暂未打通 Hessian2、Fastjson2 内置的 <code>Serializable</code> 检查配置。对于泛化调用，仅需要配置 <code>dubbo.application.check-serializable</code> 即可修改检查配置；对于 Hessian2 序列化，需要同时修改 <code>dubbo.application.check-serializable</code> 和 <code>dubbo.hessian.allowNonSerializable�</code> 两个配置；对于 Fastjson2 序列化，目前暂不支持修改。</p><h3 id=自动扫描相关配置>自动扫描相关配置</h3><p>Dubbo 类自动扫描机制共有两个配置项：<code>AutoTrustSerializeClass�</code> 是否启用自动扫描和 <code>TrustSerializeClassLevel�</code> 类信任层级。</p><p>简单来说，在开启类自动扫描之后，Dubbo 会通过 <code>ReferenceCo [...]
+注 2：目前暂未打通 Hessian2、Fastjson2 内置的 <code>Serializable</code> 检查配置。对于泛化调用，仅需要配置 <code>dubbo.application.check-serializable</code> 即可修改检查配置；对于 Hessian2 序列化，需要同时修改 <code>dubbo.application.check-serializable</code> 和 <code>dubbo.hessian.allowNonSerializable</code> 两个配置；对于 Fastjson2 序列化，目前暂不支持修改。</p><h3 id=自动扫描相关配置>自动扫描相关配置</h3><p>Dubbo 类自动扫描机制共有两个配置项：<code>AutoTrustSerializeClass</code> 是否启用自动扫描和 <code>TrustSerializeClassLevel</code> 类信任层级。</p><p>简单来说，在开启类自动扫描之后，Dubbo 会通过 <code>ReferenceConfi [...]
</span></span><span style=display:flex><span>applicationConfig<span style=color:#719e07>.</span>setAutoTrustSerializeClass<span style=color:#719e07>(</span><span style=color:#cb4b16>true</span><span style=color:#719e07>);</span>
</span></span><span style=display:flex><span>applicationConfig<span style=color:#719e07>.</span>setTrustSerializeClassLevel<span style=color:#719e07>(</span><span style=color:#2aa198>3</span><span style=color:#719e07>);</span>
</span></span></code></pre></div><p>通过 Spring XML 配置：</p><div class=highlight><pre tabindex=0 style=color:#93a1a1;background-color:#002b36;-moz-tab-size:4;-o-tab-size:4;tab-size:4><code class=language-xml data-lang=xml><span style=display:flex><span><span style=color:#268bd2><dubbo:application</span> name=<span style=color:#2aa198>"demo-provider"</span> auto-trust-serialize-class=<span style=color:#2aa198>"true"</span> trust-serialize-class-level=<span style=color:#2aa [...]
@@ -747,7 +747,7 @@ Dubbo >= 3.1.6</p><p>适用范围
</span></span></code></pre></div><p>通过 http 请求 json 格式结果：</p><div class=highlight><pre tabindex=0 style=color:#93a1a1;background-color:#002b36;-moz-tab-size:4;-o-tab-size:4;tab-size:4><code class=language-bash data-lang=bash><span style=display:flex><span>> curl http://127.0.0.1:22222/serializeWarnedClasses
</span></span><span style=display:flex><span><span style=color:#719e07>{</span><span style=color:#2aa198>"warnedClasses"</span>:<span style=color:#719e07>[</span><span style=color:#2aa198>"io.dubbo.test2.NotSerializable"</span>,<span style=color:#2aa198>"org.apache.dubbo.samples.NotSerializable"</span>,<span style=color:#2aa198>"io.dubbo.test.NotSerializable"</span>,<span style=color:#2aa198>"io.dubbo.test2.OthersSerializable"</span><span style=col [...]
</span></span></code></pre></div><blockquote><p>建议及时关注 <code>serializeWarnedClasses</code> 的结果，通过返回结果是否非空来判断是否受到攻击。</p></blockquote><div id=pre-footer><h2>反馈</h2><p class=feedback--prompt>此页是否对您有帮助？</p><button class="btn btn-primary mb-4 feedback--yes">是</button>
-<button class="btn btn-primary mb-4 feedback--no">否</button></div><script>const yes=document.querySelector(".feedback--yes"),no=document.querySelector(".feedback--no");document.querySelectorAll(".feedback--link").forEach(e=>{e.href=e.href+window.location.pathname});const sendFeedback=e=>{gtag||console.log("!gtag"),gtag("event","click",{event_category:"Helpful",event_label:window.location.pathname,value:e})},disableButtons=()=>{yes.disabled=!0,yes.classList.add("feedback--button__disabled [...]
+<button class="btn btn-primary mb-4 feedback--no">否</button></div><script>const yes=document.querySelector(".feedback--yes"),no=document.querySelector(".feedback--no");document.querySelectorAll(".feedback--link").forEach(e=>{e.href=e.href+window.location.pathname});const sendFeedback=e=>{gtag||console.log("!gtag"),gtag("event","click",{event_category:"Helpful",event_label:window.location.pathname,value:e})},disableButtons=()=>{yes.disabled=!0,yes.classList.add("feedback--button__disabled [...]
<a href="https://github.com/apache/dubbo-website/new/master/content/zh-cn/overview/mannual/java-sdk/advanced-features-and-usage/security/class-check.md?filename=change-me.md&value=---%0Atitle%3A+%22Long+Page+Title%22%0AlinkTitle%3A+%22Short+Nav+Title%22%0Aweight%3A+100%0Adescription%3A+%3E-%0A+++++Page+description+for+heading+and+indexes.%0A---%0A%0A%23%23+Heading%0A%0AEdit+this+template+to+create+your+new+page.%0A%0A%2A+Give+it+a+good+name%2C+ending+in+%60.md%60+-+e.g.+%60getting-st [...]
<a href="https://github.com/apache/dubbo-website/issues/new?title=%e7%b1%bb%e6%a3%80%e6%9f%a5%e6%9c%ba%e5%88%b6" target=_blank><i class="fab fa-github fa-fw"></i> 登记问题</a>
<a href=https://github.com/apache/dubbo/issues/new target=_blank><i class="fas fa-tasks fa-fw"></i> 提交项目问题</a></div><nav id=TableOfContents><ul><li><a href=#特性说明>特性说明</a></li><li><a href=#使用场景>使用场景</a></li><li><a href=#使用方式>使用方式</a><ul><li><a href=#检查模式>检查模式</a></li><li><a href=#serializable-接口检查>Serializable 接口检查</a></li><li><a href=#自动扫描相关配置>自动扫描相关配置</a></li><li><a href=#可信不可信类自定义配置>可信/不可信类自定义配置</a></li><li><a href=#审计方式>审计方式</a></li></ul></li></ul></nav></div></div></div></div><footer [...]
diff --git a/zh-cn/overview/mannual/java-sdk/advanced-features-and-usage/security/index.xml b/zh-cn/overview/mannual/java-sdk/advanced-features-and-usage/security/index.xml
index 1d35f2405d..b40ba5a05c 100644
--- a/zh-cn/overview/mannual/java-sdk/advanced-features-and-usage/security/index.xml
+++ b/zh-cn/overview/mannual/java-sdk/advanced-features-and-usage/security/index.xml
@@ -75,11 +75,11 @@ Dubbo &gt;= 3.1.6</p>
</span></span></code></pre></div><p>配置成功后可以在日志中看到如下的提示：</p>
<div class="highlight"><pre tabindex="0" style="color:#93a1a1;background-color:#002b36;-moz-tab-size:4;-o-tab-size:4;tab-size:4;"><code class="language-fallback" data-lang="fallback"><span style="display:flex;"><span>INFO utils.SerializeSecurityManager: [DUBBO] Serialize check serializable: true
</span></span></code></pre></div><p>注 1：在同一个进程（Dubbo Framework Model）下的多个应用如果同时配置不同的 Serializable 接口检查模式，最终会生效“最宽松”的级别。如两个 Spring Context 同时启动，一个配置为 <code>true</code>，另外一个配置为 <code>false</code>，则最终生效 <code>false</code> 级别的配置。
-注 2：目前暂未打通 Hessian2、Fastjson2 内置的 <code>Serializable</code> 检查配置。对于泛化调用，仅需要配置 <code>dubbo.application.check-serializable</code> 即可修改检查配置；对于 Hessian2 序列化，需要同时修改 <code>dubbo.application.check-serializable</code> 和 <code>dubbo.hessian.allowNonSerializable�</code> 两个配置；对于 Fastjson2 序列化，目前暂不支持修改。</p>
+注 2：目前暂未打通 Hessian2、Fastjson2 内置的 <code>Serializable</code> 检查配置。对于泛化调用，仅需要配置 <code>dubbo.application.check-serializable</code> 即可修改检查配置；对于 Hessian2 序列化，需要同时修改 <code>dubbo.application.check-serializable</code> 和 <code>dubbo.hessian.allowNonSerializable</code> 两个配置；对于 Fastjson2 序列化，目前暂不支持修改。</p>
<h3 id="自动扫描相关配置">自动扫描相关配置</h3>
-<p>Dubbo 类自动扫描机制共有两个配置项：<code>AutoTrustSerializeClass�</code> 是否启用自动扫描和 <code>TrustSerializeClassLevel�</code> 类信任层级。</p>
-<p>简单来说，在开启类自动扫描之后，Dubbo 会通过 <code>ReferenceConfig</code> 和 <code>ServiceConfig</code> 自动扫描接口所有可能会用到的相关类，并且递归信任其所在的 package。 <code>TrustSerializeClassLevel�</code> 类信任层级可以用来限制最终信任的 package 层级。如 <code>io.dubbo.test.pojo.User</code> 在 <code>TrustSerializeClassLevel�</code> 配置为 <code>3</code> 的时候，最终会信任 <code>io.dubbo.test</code> 这个 package 下所有的类。</p>
-<p>Dubbo 中默认配置 <code>AutoTrustSerializeClass�</code> 为 <code>true</code> 启用扫描， <code>TrustSerializeClassLevel�</code> 为 <code>3</code>。</p>
+<p>Dubbo 类自动扫描机制共有两个配置项：<code>AutoTrustSerializeClass</code> 是否启用自动扫描和 <code>TrustSerializeClassLevel</code> 类信任层级。</p>
+<p>简单来说，在开启类自动扫描之后，Dubbo 会通过 <code>ReferenceConfig</code> 和 <code>ServiceConfig</code> 自动扫描接口所有可能会用到的相关类，并且递归信任其所在的 package。 <code>TrustSerializeClassLevel</code> 类信任层级可以用来限制最终信任的 package 层级。如 <code>io.dubbo.test.pojo.User</code> 在 <code>TrustSerializeClassLevel</code> 配置为 <code>3</code> 的时候，最终会信任 <code>io.dubbo.test</code> 这个 package 下所有的类。</p>
+<p>Dubbo 中默认配置 <code>AutoTrustSerializeClass</code> 为 <code>true</code> 启用扫描， <code>TrustSerializeClassLevel</code> 为 <code>3</code>。</p>
<p>通过 ApplicationConfig 配置：</p>
<div class="highlight"><pre tabindex="0" style="color:#93a1a1;background-color:#002b36;-moz-tab-size:4;-o-tab-size:4;tab-size:4;"><code class="language-java" data-lang="java"><span style="display:flex;"><span>ApplicationConfig applicationConfig <span style="color:#719e07">=</span> <span style="color:#719e07">new</span> ApplicationConfig<span style="color:#719e07">();</span>
</span></span><span style="display:flex;"><span>applicationConfig<span style="color:#719e07">.</span>setAutoTrustSerializeClass<span style="color:#719e07">(</span><span style="color:#cb4b16">true</span><span style="color:#719e07">);</span>
diff --git a/zh-cn/sitemap.xml b/zh-cn/sitemap.xml
index 9dc3f0d98d..ee2ebcb8be 100644
--- a/zh-cn/sitemap.xml
+++ b/zh-cn/sitemap.xml
@@ -1 +1 @@
-<?xml version="1.0" encoding="utf-8" standalone="yes"?><urlset xmlns="http://www.sitemaps.org/schemas/sitemap/0.9" xmlns:xhtml="http://www.w3.org/1999/xhtml"><url><loc>https://cn.dubbo.apache.org/zh-cn/blog/2023/01/16/%E9%98%BF%E9%87%8C%E5%B7%B4%E5%B7%B4%E5%8D%87%E7%BA%A7-dubbo3-%E5%85%A8%E9%9D%A2%E5%8F%96%E4%BB%A3-hsf2/</loc><lastmod>2023-02-22T15:03:22+08:00</lastmod><changefreq>monthly</changefreq><priority>0.5</priority></url><url><loc>https://cn.dubbo.apache.org/zh-cn/overview/mannu [...]
\ No newline at end of file
+<?xml version="1.0" encoding="utf-8" standalone="yes"?><urlset xmlns="http://www.sitemaps.org/schemas/sitemap/0.9" xmlns:xhtml="http://www.w3.org/1999/xhtml"><url><loc>https://cn.dubbo.apache.org/zh-cn/blog/2023/01/16/%E9%98%BF%E9%87%8C%E5%B7%B4%E5%B7%B4%E5%8D%87%E7%BA%A7-dubbo3-%E5%85%A8%E9%9D%A2%E5%8F%96%E4%BB%A3-hsf2/</loc><lastmod>2023-02-22T15:03:22+08:00</lastmod><changefreq>monthly</changefreq><priority>0.5</priority></url><url><loc>https://cn.dubbo.apache.org/zh-cn/overview/mannu [...]
\ No newline at end of file