2022-10 springboot修复fastjson autoType漏洞

项目里用到了fastjson，fastjson报出了autoType高危漏洞，刚好在Redis序列化时用到了autoType特性。

方法：

1. fastjson改为无autoType特性版本；
2. 引入fastjson2，不启用autoType做Redis序列化。

pom.xml: 

<fastjson.version>1.2.67_noneautotype2</fastjson.version>
<fastjson2.version>2.0.15</fastjson2.version>

<dependency>
    <groupId>com.alibaba</groupId>
    <artifactId>fastjson</artifactId>
    <version>${fastjson.version}</version>
</dependency>
           
<dependency>
    <groupId>com.alibaba.fastjson2</groupId>
    <artifactId>fastjson2</artifactId>
    <version>${fastjson2.version}</version>
</dependency>

FastJson2JsonRedisSerializer.java 

package com.xxx;

import com.alibaba.fastjson2.JSON;
import com.alibaba.fastjson2.JSONReader;
import com.alibaba.fastjson2.JSONWriter;
import com.alibaba.fastjson2.filter.Filter;
import com.fasterxml.jackson.databind.JavaType;
import com.fasterxml.jackson.databind.ObjectMapper;
import com.fasterxml.jackson.databind.type.TypeFactory;
import java.nio.charset.Charset;
import org.springframework.data.redis.serializer.RedisSerializer;
import org.springframework.data.redis.serializer.SerializationException;
import org.springframework.util.Assert;

/**
 * Redis使用FastJson序列化
 */
public class FastJson2JsonRedisSerializer<T> implements RedisSerializer<T>
{
    @SuppressWarnings("unused")
    private ObjectMapper objectMapper = new ObjectMapper();

    public static final Charset DEFAULT_CHARSET = Charset.forName("UTF-8");

    private Class<T> clazz;

    static final Filter autoTypeFilter = JSONReader.autoTypeFilter(
        // 按需加上需要支持自动类型的类名前缀，范围越小越安全
        "org.springframework.security.core.authority.SimpleGrantedAuthority"
    );
    static {
        //开启安全模式
        System.setProperty("fastjson2.parser.safeMode", "true");
    }

    public FastJson2JsonRedisSerializer(Class<T> clazz)
    {
        super();
        this.clazz = clazz;
    }

    @Override
    public byte[] serialize(T t) throws SerializationException
    {
        if (t == null)
        {
            return new byte[0];
        }
        return JSON.toJSONString(t, JSONWriter.Feature.WriteClassName).getBytes(DEFAULT_CHARSET);
    }

    @Override
    public T deserialize(byte[] bytes) throws SerializationException
    {
        if (bytes == null || bytes.length <= 0)
        {
            return null;
        }
        String str = new String(bytes, DEFAULT_CHARSET);

        return JSON.parseObject(str, clazz, autoTypeFilter, JSONReader.Feature.SupportAutoType);
    }

    public void setObjectMapper(ObjectMapper objectMapper)
    {
        Assert.notNull(objectMapper, "'objectMapper' must not be null");
        this.objectMapper = objectMapper;
    }

    protected JavaType getJavaType(Class<?> clazz)
    {
        return TypeFactory.defaultInstance().constructType(clazz);
    }
}

最后说一下这样改的目的：

1. 保留原有fastjson的api不修改业务代码；
2. 不启用autoType，利用fastjson2的JSON序列化，并开启安全模式，避免autoType漏洞

有效果的留个言吧