Re: [PR] Fix InputStream deserialization bug [dubbo-hessian-lite]

["AlbumenJ (via GitHub)" <gi...@apache.org>]

AlbumenJ commented on code in PR #76:
URL: https://github.com/apache/dubbo-hessian-lite/pull/76#discussion_r1974636073


##########
hessian-lite/src/main/java/com/alibaba/com/caucho/hessian/io/InputStreamDeserializer.java:
##########
@@ -48,20 +48,78 @@
 
 package com.alibaba.com.caucho.hessian.io;
 
-import java.io.IOException;
+import java.io.*;
+import java.util.UUID;
 
 /**
+ * InputStream Deserializer
  * Serializing a stream object.
+ * @author HeYuJie
+ * @date 2024/10/31
  */
 public class InputStreamDeserializer extends AbstractDeserializer {
     public static final InputStreamDeserializer DESER
             = new InputStreamDeserializer();
 
+    // TODO Allow external configuration
+    @SuppressWarnings("FieldCanBeLocal")
+    private final int bufferSize = Hessian2Output.SIZE;
+    // TODO Allow external configuration
+    private final File tmpDir;
+
     public InputStreamDeserializer() {
+        tmpDir = new File(System.getProperty("java.io.tmpdir"), "dubbo-"+ System.currentTimeMillis());
+        if(!tmpDir.exists()){
+            //noinspection ResultOfMethodCallIgnored
+            tmpDir.mkdirs();
+        }
     }
 
-    public Object readObject(AbstractHessianInput in)
-            throws IOException {
-        return in.readInputStream();
+    public Object readObject(AbstractHessianInput in) throws IOException {
+
+        FileOutputStream out = null;
+        try {
+            @SuppressWarnings("resource")
+            InputStream input = in.readInputStream();
+            // Read twice the size of the buffer (16k)
+            byte[] bytes = new byte[bufferSize * 2];
+            File file = null;
+            while (true) { // Loop reading
+
+                int len = input.read(bytes, 0, bytes.length);
+
+                if (out == null) {
+
+                    // If the length of InputStream is less than the buffer, creating a byte stream returns
+                    if (len <= bufferSize) {
+                        byte[] buff = new byte[len];
+                        System.arraycopy(bytes, 0, buff, 0, len);
+                        return new ByteArrayInputStream(buff);
+                    }
+
+                    // If the length of InputStream is greater than the buffer, create a temporary file and return it
+                    String name = String.format("%d-%s.dubbo.tmp", System.currentTimeMillis(), UUID.randomUUID().toString().replace("-", ""));
+                    file = new File(tmpDir, name);
+                    // Close the stream in finally
+                    //noinspection resource
+                    out = new FileOutputStream(file);

Review Comment:
   Using temp file in `serilalization` directly is not a good idea



-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: notifications-unsubscribe@dubbo.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org


---------------------------------------------------------------------
To unsubscribe, e-mail: notifications-unsubscribe@dubbo.apache.org
For additional commands, e-mail: notifications-help@dubbo.apache.org