[2.6.X]Add some serialize check

dubbo-cluster/src/main/java/com/alibaba/dubbo/rpc/cluster/router/script/ScriptRouter.java

@@ -20,6 +20,7 @@
 import com.alibaba.dubbo.common.URL;
 import com.alibaba.dubbo.common.logger.Logger;
 import com.alibaba.dubbo.common.logger.LoggerFactory;
+import com.alibaba.dubbo.common.utils.StringUtils;
 import com.alibaba.dubbo.rpc.Invocation;
 import com.alibaba.dubbo.rpc.Invoker;
 import com.alibaba.dubbo.rpc.RpcContext;
@@ -32,6 +33,13 @@
 import javax.script.ScriptEngine;
 import javax.script.ScriptEngineManager;
 import javax.script.ScriptException;
+import java.security.AccessControlContext;
+import java.security.AccessController;
+import java.security.CodeSource;
+import java.security.Permissions;
+import java.security.PrivilegedAction;
+import java.security.ProtectionDomain;
+import java.security.cert.Certificate;
 import java.util.ArrayList;
 import java.util.Arrays;
 import java.util.List;
@@ -53,17 +61,51 @@ public class ScriptRouter extends AbstractRouter {
 
     private final String rule;
 
+    private CompiledScript function;
+
+    private AccessControlContext accessControlContext;
+
+    {
+        //Just give permission of reflect to access member.
+        Permissions perms = new Permissions();
+        perms.add(new RuntimePermission("accessDeclaredMembers"));
+        // Cast to Certificate[] required because of ambiguity:
+        ProtectionDomain domain = new ProtectionDomain(new CodeSource(null, (Certificate[]) null), perms);
+        accessControlContext = new AccessControlContext(new ProtectionDomain[]{domain});
+    }
+
     public ScriptRouter(URL url) {
         this.url = url;
-        String type = url.getParameter(Constants.TYPE_KEY);
         this.priority = url.getParameter(Constants.PRIORITY_KEY, DEFAULT_PRIORITY);
-        String rule = url.getParameterAndDecoded(Constants.RULE_KEY);
-        if (type == null || type.length() == 0) {
-            type = Constants.DEFAULT_SCRIPT_TYPE_KEY;
+
+        this.engine = getEngine(url);
+        this.rule = getRule(url);
+
+        try {
+            Compilable compilable = (Compilable) engine;
+            function = compilable.compile(rule);
+        } catch (ScriptException e) {
+            logger.error("route error, rule has been ignored. rule: " + rule +
+                    ", url: " + RpcContext.getContext().getUrl(), e);
         }
-        if (rule == null || rule.length() == 0) {
-            throw new IllegalStateException(new IllegalStateException("route rule can not be empty. rule:" + rule));
+    }
+
+    /**
+     * get rule from url parameters.
+     */
+    private String getRule(URL url) {
+        String vRule = url.getParameterAndDecoded(Constants.RULE_KEY);
+        if (StringUtils.isEmpty(vRule)) {
+            throw new IllegalStateException("route rule can not be empty.");
         }
+        return vRule;
+    }
+
+    /**
+     * create ScriptEngine instance by type from url parameters, then cache it
+     */
+    private ScriptEngine getEngine(URL url) {
+        String type = url.getParameter(Constants.TYPE_KEY, Constants.DEFAULT_SCRIPT_TYPE_KEY);
         ScriptEngine engine = engines.get(type);
         if (engine == null) {
             engine = new ScriptEngineManager().getEngineByName(type);
@@ -72,38 +114,61 @@ public ScriptRouter(URL url) {
             }
             engines.put(type, engine);
         }
-        this.engine = engine;
-        this.rule = rule;
+
+        return engine;
     }
 
+
     @Override
     @SuppressWarnings("unchecked")
-    public <T> List<Invoker<T>> route(List<Invoker<T>> invokers, URL url, Invocation invocation) throws RpcException {
-        try {
-            List<Invoker<T>> invokersCopy = new ArrayList<Invoker<T>>(invokers);
-            Compilable compilable = (Compilable) engine;
-            Bindings bindings = engine.createBindings();
-            bindings.put("invokers", invokersCopy);
-            bindings.put("invocation", invocation);
-            bindings.put("context", RpcContext.getContext());
-            CompiledScript function = compilable.compile(rule);
-            Object obj = function.eval(bindings);
-            if (obj instanceof Invoker[]) {
-                invokersCopy = Arrays.asList((Invoker<T>[]) obj);
-            } else if (obj instanceof Object[]) {
-                invokersCopy = new ArrayList<Invoker<T>>();
-                for (Object inv : (Object[]) obj) {
-                    invokersCopy.add((Invoker<T>) inv);
+    public <T> List<Invoker<T>> route(final List<Invoker<T>> invokers, URL url, final Invocation invocation) throws RpcException {
+        if (engine == null || function == null) {
+            return invokers;
+        }
+        final Bindings bindings = createBindings(invokers, invocation);
+        return getRoutedInvokers(AccessController.doPrivileged(new PrivilegedAction() {
+            @Override
+            public Object run() {
+                try {
+                    return function.eval(bindings);
+                } catch (ScriptException e) {
+                    logger.error("route error, rule has been ignored. rule: " + rule + ", method:" +
+                            invocation.getMethodName() + ", url: " + RpcContext.getContext().getUrl(), e);
+                    return invokers;
                 }
-            } else {
-                invokersCopy = (List<Invoker<T>>) obj;
             }
-            return invokersCopy;
-        } catch (ScriptException e) {
-            //fail then ignore rule .invokers.
-            logger.error("route error , rule has been ignored. rule: " + rule + ", method:" + invocation.getMethodName() + ", url: " + RpcContext.getContext().getUrl(), e);
+        }, accessControlContext));
+    }
+
+    /**
+     * get routed invokers from result of script rule evaluation
+     */
+    @SuppressWarnings("unchecked")
+    protected <T> List<Invoker<T>> getRoutedInvokers(Object obj) {
+        if (obj instanceof Invoker[]) {
+            return Arrays.asList((Invoker<T>[]) obj);
+        } else if (obj instanceof Object[]) {
+            Object[] objects = (Object[]) obj;
+            List<Invoker<T>> invokers = new ArrayList<Invoker<T>>();
+            for (Object object : objects) {
+                invokers.add((Invoker<T>) object);
+            }
+
             return invokers;
+        } else {
+            return (List<Invoker<T>>) obj;
         }
     }
 
+    /**
+     * create bindings for script engine
+     */
+    private <T> Bindings createBindings(List<Invoker<T>> invokers, Invocation invocation) {
+        Bindings bindings = engine.createBindings();
+        // create a new List of invokers
+        bindings.put("invokers", new ArrayList<Invoker<T>>(invokers));
+        bindings.put("invocation", invocation);
+        bindings.put("context", RpcContext.getContext());
+        return bindings;
+    }
 }

dubbo-cluster/src/main/resources/META-INF/dubbo/internal/com.alibaba.dubbo.rpc.cluster.RouterFactory

@@ -1,3 +1,2 @@
 file=com.alibaba.dubbo.rpc.cluster.router.file.FileRouterFactory
-script=com.alibaba.dubbo.rpc.cluster.router.script.ScriptRouterFactory
 condition=com.alibaba.dubbo.rpc.cluster.router.condition.ConditionRouterFactory

dubbo-cluster/src/test/resources/META-INF/dubbo/internal/com.alibaba.dubbo.rpc.cluster.RouterFactory

@@ -0,0 +1 @@
+script=com.alibaba.dubbo.rpc.cluster.router.script.ScriptRouterFactory

dubbo-common/src/main/java/com/alibaba/dubbo/common/Constants.java

@@ -647,8 +647,17 @@ public class Constants {
 
     public static final String TELNET = "telnet";
 
-    /*
-     * private Constants(){ }
-     */
+    public static final String DOT_REGEX = "\\.";
+
+    public static final String UNDERLINE_SEPARATOR = "_";
+
+    public static final String CLASS_DESERIALIZE_BLOCK_ALL = "dubbo.security.serialize.blockAllClassExceptAllow";
+
+    public static final String CLASS_DESERIALIZE_ALLOWED_LIST = "dubbo.security.serialize.allowedClassList";
+
+    public static final String CLASS_DESERIALIZE_BLOCKED_LIST = "dubbo.security.serialize.blockedClassList";
+
+    public static final String ENABLE_NATIVE_JAVA_GENERIC_SERIALIZE = "dubbo.security.serialize.generic.native-java-enable";
 
+    public static final String SERIALIZE_BLOCKED_LIST_FILE_PATH = "security/serialize.blockedlist";
 }

dubbo-common/src/main/java/com/alibaba/dubbo/common/URL.java

@@ -204,6 +204,13 @@ public static URL valueOf(String url) {
             }
             url = url.substring(0, i);
         }
+
+        // ignore the url content following '#'
+        int poundIndex = url.indexOf('#');
+        if (poundIndex != -1) {
+            url = url.substring(0, poundIndex);
+        }
+
         i = url.indexOf("://");
         if (i >= 0) {
             if (i == 0) throw new IllegalStateException("url missing protocol: \"" + url + "\"");

dubbo-common/src/main/java/com/alibaba/dubbo/common/beanutil/JavaBeanSerializeUtil.java

@@ -20,6 +20,7 @@
 import com.alibaba.dubbo.common.logger.LoggerFactory;
 import com.alibaba.dubbo.common.utils.LogHelper;
 import com.alibaba.dubbo.common.utils.ReflectUtils;
+import com.alibaba.dubbo.common.utils.SerializeClassChecker;
 
 import java.lang.reflect.Array;
 import java.lang.reflect.Constructor;
@@ -439,6 +440,7 @@ public static Class<?> name2Class(ClassLoader loader, String name) throws ClassN
         if (isReferenceType(name)) {
             name = name.substring(1, name.length() - 1);
         }
+        SerializeClassChecker.getInstance().validateClass(name);
         return Class.forName(name, false, loader);
     }