You are viewing a plain text version of this content. The canonical link for it is here.
Posted to notifications@dubbo.apache.org by "weimin0426 (via GitHub)" <gi...@apache.org> on 2024/05/21 08:47:15 UTC
[I] [Bug] security/serialize.allowlist overwrite by dubbo framework [dubbo]
weimin0426 opened a new issue, #14226:
URL: https://github.com/apache/dubbo/issues/14226
### Pre-check
- [X] I am sure that all the content I provide is in English.
### Search before asking
- [X] I had searched in the [issues](https://github.com/apache/dubbo/issues?q=is%3Aissue) and found no similar issues.
### Apache Dubbo Component
Java Benchmark (apache/dubbo-benchmark)
### Dubbo Version
dubbo 3.2.5
### Steps to reproduce this issue
I have added some content to security/serialize.allowlist, eg:
benchmark.service.UserServiceResponse
but after I package the project and put to the remote server, I got the message:
cause: org.apache.dubbo.common.serialize.SerializationException: io.fury.exception.InsecureException: Class benchmark.service.UserServiceResponse isn't in allow list for serialization. If this class is allowed for serialization, please add it to allow list by AllowListChecker#addAllowClass
then I unzip the jar files with jar -xf, I found security/serialize.allowlist was overwrite, it has the same content with the file in dubbo project ,which placed at security/serialize.allowlist.
### What you expected to happen
benchmark.service.UserServiceResponse defined in the security/serialize.allowlist can be affected
### Anything else
_No response_
### Are you willing to submit a pull request to fix on your own?
- [ ] Yes I am willing to submit a pull request on my own!
### Code of Conduct
- [X] I agree to follow this project's [Code of Conduct](https://www.apache.org/foundation/policies/conduct)
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@dubbo.apache.org.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@dubbo.apache.org
For additional commands, e-mail: notifications-help@dubbo.apache.org
Re: [I] [Bug] security/serialize.allowlist overwrite by dubbo framework [dubbo]
Posted by "weimin0426 (via GitHub)" <gi...@apache.org>.
weimin0426 closed issue #14226: [Bug] security/serialize.allowlist overwrite by dubbo framework
URL: https://github.com/apache/dubbo/issues/14226
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@dubbo.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@dubbo.apache.org
For additional commands, e-mail: notifications-help@dubbo.apache.org
Re: [I] [Bug] security/serialize.allowlist overwrite by dubbo framework [dubbo]
Posted by "Stellar1999 (via GitHub)" <gi...@apache.org>.
Stellar1999 commented on issue #14226:
URL: https://github.com/apache/dubbo/issues/14226#issuecomment-2124288790
I see it, and I think it might be because you are using the 'assembly-plugin'. Maybe you can use the 'shadow-plugin' to resolve this issue.
https://maven.apache.org/plugins/maven-shade-plugin/examples/includes-excludes.html
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@dubbo.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@dubbo.apache.org
For additional commands, e-mail: notifications-help@dubbo.apache.org
Re: [I] [Bug] security/serialize.allowlist overwrite by dubbo framework [dubbo]
Posted by "weimin0426 (via GitHub)" <gi...@apache.org>.
weimin0426 commented on issue #14226:
URL: https://github.com/apache/dubbo/issues/14226#issuecomment-2124210642
> Could you provide a demo?
You can reproduce the steps as follows:
I fork a branch from https://github.com/apache/dubbo-benchmark.git, then I add a new submodule named dubbo-fury-server with the submoudle dubbo-grpc-server, and changed the maven build config like above.
This may be caused by the maven package option. If you use the default maven package option, the issue will not occur.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@dubbo.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@dubbo.apache.org
For additional commands, e-mail: notifications-help@dubbo.apache.org
Re: [I] [Bug] security/serialize.allowlist overwrite by dubbo framework [dubbo]
Posted by "wcy666103 (via GitHub)" <gi...@apache.org>.
wcy666103 commented on issue #14226:
URL: https://github.com/apache/dubbo/issues/14226#issuecomment-2122616185
I think it should be the problem of your packaging method. You can refer to this project https://github.com/apache/dubbo-samples/tree/fce381c2c11f87805dede48c4f18a8e336698c1a/2-advanced/dubbo-samples-triple-rest/dubbo-samples-triple-rest-jaxrs . The changes I made based on this project and the contents in the jar package after packaging are correct, you can refer to the packaging method of this project
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@dubbo.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@dubbo.apache.org
For additional commands, e-mail: notifications-help@dubbo.apache.org
Re: [I] [Bug] security/serialize.allowlist overwrite by dubbo framework [dubbo]
Posted by "Stellar1999 (via GitHub)" <gi...@apache.org>.
Stellar1999 commented on issue #14226:
URL: https://github.com/apache/dubbo/issues/14226#issuecomment-2122596916
Could you provide a demo?
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@dubbo.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@dubbo.apache.org
For additional commands, e-mail: notifications-help@dubbo.apache.org
Re: [I] [Bug] security/serialize.allowlist overwrite by dubbo framework [dubbo]
Posted by "wcy666103 (via GitHub)" <gi...@apache.org>.
wcy666103 commented on issue #14226:
URL: https://github.com/apache/dubbo/issues/14226#issuecomment-2124304434
> > I think it should be the problem of your packaging method. You can refer to this project https://github.com/apache/dubbo-samples/tree/fce381c2c11f87805dede48c4f18a8e336698c1a/2-advanced/dubbo-samples-triple-rest/dubbo-samples-triple-rest-jaxrs . The changes I made based on this project and the contents in the jar package after packaging are correct, you can refer to the packaging method of this project
> > 
>
> yes，it happened when I try to build a single with-dependencies jars with maven conf:
>
> ```
> <plugin>
> <artifactId>maven-assembly-plugin</artifactId>
> <version>3.1.0</version>
> <configuration>
> <descriptorRefs>
> <descriptorRef>jar-with-dependencies</descriptorRef>
> </descriptorRefs>
> <archive>
> <manifest>
> <mainClass>benchmark.rpc.Server</mainClass>
> </manifest>
> </archive>
> </configuration>
> <executions>
> <execution>
> <id>make-assembly</id> <!-- this is used for inheritance merges -->
> <phase>package</phase> <!-- bind to the packaging phase -->
> <goals>
> <goal>single</goal>
> </goals>
> </execution>
> </executions>
> </plugin>
> </plugins>
> </build
> ```
This seems to be a problem for your own use, and there are many solutions for similar problems, you can refer to this article: https://www.jb51.net/program/285358oad.htm
Finally, please close this issue as completed
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@dubbo.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@dubbo.apache.org
For additional commands, e-mail: notifications-help@dubbo.apache.org
Re: [I] [Bug] security/serialize.allowlist overwrite by dubbo framework [dubbo]
Posted by "weimin0426 (via GitHub)" <gi...@apache.org>.
weimin0426 commented on issue #14226:
URL: https://github.com/apache/dubbo/issues/14226#issuecomment-2124194155
> I think it should be the problem of your packaging method. You can refer to this project https://github.com/apache/dubbo-samples/tree/fce381c2c11f87805dede48c4f18a8e336698c1a/2-advanced/dubbo-samples-triple-rest/dubbo-samples-triple-rest-jaxrs . The changes I made based on this project and the contents in the jar package after packaging are correct, you can refer to the packaging method of this project
>
> 
yes，it happened when I try to build a single with-dependencies jars with maven conf:
<build>
<plugins>
<!-- will be overwrited-->
<plugin>
<artifactId>maven-assembly-plugin</artifactId>
<version>3.1.0</version>
<configuration>
<descriptorRefs>
<descriptorRef>jar-with-dependencies</descriptorRef>
</descriptorRefs>
<archive>
<manifest>
<mainClass>benchmark.rpc.Server</mainClass>
</manifest>
</archive>
</configuration>
<executions>
<execution>
<id>make-assembly</id> <!-- this is used for inheritance merges -->
<phase>package</phase> <!-- bind to the packaging phase -->
<goals>
<goal>single</goal>
</goals>
</execution>
</executions>
</plugin>
</plugins>
</build
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@dubbo.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@dubbo.apache.org
For additional commands, e-mail: notifications-help@dubbo.apache.org
Re: [I] [Bug] security/serialize.allowlist overwrite by dubbo framework [dubbo]
Posted by "weimin0426 (via GitHub)" <gi...@apache.org>.
weimin0426 commented on issue #14226:
URL: https://github.com/apache/dubbo/issues/14226#issuecomment-2122563568
> I tried to package using the dubbo-sample and did not reproduce this issue. <img alt="image" width="895" src="https://private-user-images.githubusercontent.com/137587347/332366158-90b66b42-76aa-4b84-979d-c5c3806b8c89.png?jwt=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJpc3MiOiJnaXRodWIuY29tIiwiYXVkIjoicmF3LmdpdGh1YnVzZXJjb250ZW50LmNvbSIsImtleSI6ImtleTUiLCJleHAiOjE3MTYyOTU5NjcsIm5iZiI6MTcxNjI5NTY2NywicGF0aCI6Ii8xMzc1ODczNDcvMzMyMzY2MTU4LTkwYjY2YjQyLTc2YWEtNGI4NC05NzlkLWM1YzM4MDZiOGM4OS5wbmc_WC1BbXotQWxnb3JpdGhtPUFXUzQtSE1BQy1TSEEyNTYmWC1BbXotQ3JlZGVudGlhbD1BS0lBVkNPRFlMU0E1M1BRSzRaQSUyRjIwMjQwNTIxJTJGdXMtZWFzdC0xJTJGczMlMkZhd3M0X3JlcXVlc3QmWC1BbXotRGF0ZT0yMDI0MDUyMVQxMjQ3NDdaJlgtQW16LUV4cGlyZXM9MzAwJlgtQW16LVNpZ25hdHVyZT01ZGJmNTYzZjYxYTBhZTk4MWU2MmIyMzZiNzQ3N2I4NTFjZjAzMTY2OGJhM2YyZDE2MzBjZDhlYjNiYTRlZGQ5JlgtQW16LVNpZ25lZEhlYWRlcnM9aG9zdCZhY3Rvcl9pZD0wJmtleV9pZD0wJnJlcG9faWQ9MCJ9.8QYBwq8ZuBGfI8wLTt45f5FcsxUjIJ41XS9YZX90gL8"> Your screenshot looks like it's from the dubbo library? Mayb
e you should check the files within the jar package itself, or could you provide a demo to reproduce this problem?
here is the content after 'jar xf' command:
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@dubbo.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@dubbo.apache.org
For additional commands, e-mail: notifications-help@dubbo.apache.org
Re: [I] [Bug] security/serialize.allowlist overwrite by dubbo framework [dubbo]
Posted by "weimin0426 (via GitHub)" <gi...@apache.org>.
weimin0426 commented on issue #14226:
URL: https://github.com/apache/dubbo/issues/14226#issuecomment-2122576874
maybe it was caused by the package types? I build a package without dependencies, the allowlist is corrected.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@dubbo.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@dubbo.apache.org
For additional commands, e-mail: notifications-help@dubbo.apache.org
Re: [I] [Bug] security/serialize.allowlist overwrite by dubbo framework [dubbo]
Posted by "Stellar1999 (via GitHub)" <gi...@apache.org>.
Stellar1999 commented on issue #14226:
URL: https://github.com/apache/dubbo/issues/14226#issuecomment-2122186900
I tried to package using the dubbo-sample and did not reproduce this issue.
<img width="895" alt="image" src="https://github.com/apache/dubbo/assets/137587347/90b66b42-76aa-4b84-979d-c5c3806b8c89">
Your screenshot looks like it's from the dubbo library? Maybe you should check the files within the jar package itself, or could you provide a demo to reproduce this problem?
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: notifications-unsubscribe@dubbo.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@dubbo.apache.org
For additional commands, e-mail: notifications-help@dubbo.apache.org