This is an automated email from the ASF dual-hosted git repository.
albumenj pushed a commit to branch master
in repository https://gitbox.apache.org/repos/asf/dubbo-website.git
The following commit(s) were added to refs/heads/master by this push:
new 50655fa0ec Add serialize check docs (#2087)
50655fa0ec is described below
commit 50655fa0ec83c3e9f0ba0f17547d9cb0728adc37
Author: Albumen Kevin <[email protected]>
AuthorDate: Sun Feb 5 09:16:05 2023 +0800
Add serialize check docs (#2087)
---
.../security/class-check.md | 215 ++++++++++++++++++++
.../java-sdk/reference-manual/qos/security.md | 75 +++++++
.../security/class-check.md | 216 +++++++++++++++++++++
.../java-sdk/reference-manual/qos/security.md | 75 +++++++
4 files changed, 581 insertions(+)
diff --git
a/content/en/docs3-v2/java-sdk/advanced-features-and-usage/security/class-check.md
b/content/en/docs3-v2/java-sdk/advanced-features-and-usage/security/class-check.md
new file mode 100644
index 0000000000..a302deb07d
--- /dev/null
+++
b/content/en/docs3-v2/java-sdk/advanced-features-and-usage/security/class-check.md
@@ -0,0 +1,215 @@
+---
+type: docs
+title: "Dubbo Class Inspection Mechanism"
+linkTitle: "Dubbo Class Inspection Mechanism"
+weight: 1
+description: "Understand the Dubbo class inspection mechanism"
+---
+
+## Supported versions
+
+Dubbo >= 3.1.6
+
+## Scope of application
+Currently, the serialization check supports Hessian2, Fastjson2 serialization
and generalized calls. Other serialization methods are not currently supported.
+
+## configuration method
+
+### 1. Check mode
+The inspection mode is divided into three levels: `STRICT` strict inspection,
`WARN` warning, `DISABLED` disabled.
+`STRICT` Strict checks: disallow deserialization of all classes that are not
in the allowed serialization list (whitelist).
+`WARN` warning: only prohibits serialization of all classes in the disallowed
serialization list (blacklist), and alerts through logs when deserializing
classes that are not in the allowed serialization list (whitelist).
+`DISABLED` Disabled: Do not do any checks.
+
+Version 3.1 defaults to `WARN` warning level, and version 3.2 defaults to
`STRICT` strict checking level.
+
+Configuration via ApplicationConfig:
+```java
+ApplicationConfig applicationConfig = new ApplicationConfig();
+applicationConfig.setSerializeCheckStatus("STRICT");
+```
+
+Configuration via Spring XML:
+```xml
+<dubbo:application name="demo-provider" serialize-check-status="STRICT"/>
+```
+
+Configure via Spring Properties / dubbo.properties:
+```properties
+dubbo.application.serialize-check-status=STRICT
+```
+
+Configure via System Property:
+```properties
+-Ddubbo.application.serialize-check-status=STRICT
+```
+
+After the configuration is successful, you can see the following prompts in
the log:
+```
+INFO utils.SerializeSecurityManager: [DUBBO] Serialize check level: STRICT
+```
+
+Note: If multiple applications under the same process (Dubbo Framework Model)
are configured with different inspection modes at the same time, the
"loosenest" level will eventually take effect. If two Spring Contexts are
started at the same time, one is configured as `STRICT` and the other is
configured as `WARN`, the `WARN` level configuration will finally take effect.
+
+### 2. Serializable interface check
+
+The Serializable interface check mode is divided into two levels: `true` is
enabled, and `false` is disabled. When the check is turned on, it will refuse
to deserialize all classes that do not implement `Serializable`.
+
+The default configuration in Dubbo is `true` to enable the check.
+
+Configuration via ApplicationConfig:
+```java
+ApplicationConfig applicationConfig = new ApplicationConfig();
+applicationConfig.setCheckSerializable(true);
+```
+
+Configuration via Spring XML:
+```xml
+<dubbo:application name="demo-provider" check-serializable="true"/>
+```
+
+Configure via Spring Properties / dubbo.properties:
+```properties
+dubbo.application.check-serializable=true
+```
+
+Configure via System Property:
+```properties
+-Ddubbo.application.check-serializable=true
+```
+
+After the configuration is successful, you can see the following prompts in
the log:
+```
+INFO utils.SerializeSecurityManager: [DUBBO] Serialize check serializable: true
+```
+
+Note 1: If multiple applications under the same process (Dubbo Framework
Model) are configured with different Serializable interface inspection modes at
the same time, the "loosenest" level will eventually take effect. If two Spring
Contexts are started at the same time, one configured as `true` and the other
configured as `false`, the `false` level configuration will finally take effect.
+Note 2: At present, the built-in `Serializable` check configuration of
Hessian2 and Fastjson2 has not been opened. For generalized calls, you only
need to configure `dubbo.application.check-serializable` to modify the check
configuration; for Hessian2 serialization, you need to modify
`dubbo.application.check-serializable` and `dubbo.hessian.allowNonSerializable`
at the same time
+
+### 3. Automatically scan related configurations
+
+There are two configuration items in the Dubbo class automatic scanning
mechanism: `AutoTrustSerializeClass
+
+To put it simply, after automatic class scanning is enabled, Dubbo will
automatically scan all related classes that may be used by the interface
through `ReferenceConfig` and `ServiceConfig`, and recursively trust its
package. `TrustSerializeClassLevel
+
+The default configuration in Dubbo is `AutoTrustSerializeClass
+
+Configuration via ApplicationConfig:
+```java
+ApplicationConfig applicationConfig = new ApplicationConfig();
+applicationConfig.setAutoTrustSerializeClass(true);
+applicationConfig.setTrustSerializeClassLevel(3);
+```
+
+Configuration via Spring XML:
+```xml
+<dubbo:application name="demo-provider" auto-trust-serialize-class="true"
trust-serialize-class-level="3"/>
+```
+
+Configure via Spring Properties / dubbo.properties:
+```properties
+dubbo.application.auto-trust-serialize-class=true
+dubbo.application.trust-serialize-class-level=3
+```
+
+Configure via System Property:
+```properties
+-Ddubbo.application.auto-trust-serialize-class=true
+-Ddubbo.application.trust-serialize-class-level=3
+```
+
+After the configuration is successful, you can use the QoS command to check
whether the results of the currently loaded trusted classes meet expectations.
+
+Note: After the check is enabled, there will be a certain performance loss
during the startup process.
+
+### 4. Custom configuration of trusted/untrusted classes
+
+In addition to Dubbo's automatic scanning classes, it also supports
configuration of trusted/untrusted class lists through resource files.
+
+Configuration method: define the following files under the resource directory
(resource).
+
+```properties
+# security/serialize.allowlist
+io.dubbo.test
+```
+
+```properties
+# security/serialize.blockedlist
+io.dubbo.block
+```
+
+After the configuration is successful, you can see the following prompts in
the log:
+```properties
+INFO utils.SerializeSecurityConfigurator: [DUBBO] Read serialize allow list
from
file:/Users/albumen/code/dubbo-samples/99-integration/dubbo-samples-serialize-check/target/classes/security/serialize.allowlist
+INFO utils.SerializeSecurityConfigurator: [DUBBO] Read serialize blocked list
from
file:/Users/albumen/code/dubbo-samples/99-integration/dubbo-samples-serialize-check/target/classes/security/serialize.blockedlist
+```
+
+The configuration priority is: user-defined trusted class = built-in trusted
class of the framework > user-defined untrusted class = built-in untrusted
class of the framework > automatic class scanning trusted class.
+
+## Audit method
+
+Dubbo supports real-time viewing of current configuration information and
trusted/untrusted class lists through QoS commands. Currently supports two
commands: `serializeCheckStatus` to view the current configuration information,
`serializeWarnedClasses` to view the real-time alarm list.
+
+1. `serializeCheckStatus` View the current configuration information
+
+Access directly through the console:
+```bash
+> telnet 127.0.0.1 22222
+Trying 127.0.0.1...
+Connected to localhost.
+Escape character is '^]'.
+ ___ __ __ ___ ___ ____
+ / _ \ / / / // _ ) / _ ) / __ \
+ / // // /_/ // _ |/ _ |/ /_/ /
+/____/ \____//____//____/ \____/
+dubbo>serializeCheckStatus
+CheckStatus: WARN
+
+CheckSerializable: true
+
+AllowedPrefix:
+...
+
+DisAllowedPrefix:
+...
+
+
+dubbo>
+```
+
+Request the result in json format via http:
+```bash
+> curl http://127.0.0.1:22222/serializeCheckStatus
+{"checkStatus":
"WARN","allowedPrefix":[...],"checkSerializable":true,"disAllowedPrefix":[...]}
+```
+
+2. `serializeWarnedClasses` view real-time warning list
+
+Access directly through the console:
+```bash
+> telnet 127.0.0.1 22222
+Trying 127.0.0.1...
+Connected to localhost.
+Escape character is '^]'.
+ ___ __ __ ___ ___ ____
+ / _ \ / / / // _ ) / _ ) / __ \
+ / // // /_/ // _ |/ _ |/ /_/ /
+/____/ \____//____//____/ \____/
+dubbo>serializeWarnedClasses
+Warned Classes:
+io.dubbo.test.NotSerializable
+io.dubbo.test2.NotSerializable
+io.dubbo.test2.OthersSerializable
+org.apache.dubbo.samples.NotSerializable
+
+
+dubbo>
+```
+
+Request the result in json format via http:
+```bash
+> curl http://127.0.0.1:22222/serializeWarnedClasses
+{"warnedClasses":["io.dubbo.test2.NotSerializable","org.apache.dubbo.samples.NotSerializable","io.dubbo.test.NotSerializable","io.dubbo.test2.OthersSerializable"]}
+```
+
+Note: It is recommended to pay attention to the result of
`serializeWarnedClasses` in time, and judge whether it is attacked by whether
the returned result is not empty.
\ No newline at end of file
diff --git a/content/en/docs3-v2/java-sdk/reference-manual/qos/security.md
b/content/en/docs3-v2/java-sdk/reference-manual/qos/security.md
new file mode 100644
index 0000000000..555d13511f
--- /dev/null
+++ b/content/en/docs3-v2/java-sdk/reference-manual/qos/security.md
@@ -0,0 +1,75 @@
+---
+type: docs
+title: "Serialization Security Audit"
+linkTitle: "Serialization Security Audit"
+weight: 9
+description: "Serialization Security Audit"
+---
+
+Dubbo supports real-time viewing of current configuration information and
trusted/untrusted class lists through QoS commands. Currently supports two
commands: `serializeCheckStatus` to view the current configuration information,
`serializeWarnedClasses` to view the real-time alarm list.
+
+### `serializeCheckStatus` command
+
+Access directly through the console:
+```bash
+> telnet 127.0.0.1 22222
+Trying 127.0.0.1...
+Connected to localhost.
+Escape character is '^]'.
+ ___ __ __ ___ ___ ____
+ / _ \ / / / // _ ) / _ ) / __ \
+ / // // /_/ // _ |/ _ |/ /_/ /
+/____/ \____//____//____/ \____/
+dubbo>serializeCheckStatus
+CheckStatus: WARN
+
+CheckSerializable: true
+
+AllowedPrefix:
+...
+
+DisAllowedPrefix:
+...
+
+
+dubbo>
+```
+
+Request the result in json format via http:
+```bash
+> curl http://127.0.0.1:22222/serializeCheckStatus
+{"checkStatus":
"WARN","allowedPrefix":[...],"checkSerializable":true,"disAllowedPrefix":[...]}
+```
+
+### `serializeWarnedClasses` command
+
+Access directly through the console:
+```bash
+> telnet 127.0.0.1 22222
+Trying 127.0.0.1...
+Connected to localhost.
+Escape character is '^]'.
+ ___ __ __ ___ ___ ____
+ / _ \ / / / // _ ) / _ ) / __ \
+ / // // /_/ // _ |/ _ |/ /_/ /
+/____/ \____//____//____/ \____/
+dubbo>serializeWarnedClasses
+Warned Classes:
+io.dubbo.test.NotSerializable
+io.dubbo.test2.NotSerializable
+io.dubbo.test2.OthersSerializable
+org.apache.dubbo.samples.NotSerializable
+
+
+dubbo>
+```
+
+Request the result in json format via http:
+```bash
+> curl http://127.0.0.1:22222/serializeWarnedClasses
+{"warnedClasses":["io.dubbo.test2.NotSerializable","org.apache.dubbo.samples.NotSerializable","io.dubbo.test.NotSerializable","io.dubbo.test2.OthersSerializable"]}
+```
+
+Note: It is recommended to pay attention to the result of
`serializeWarnedClasses` in time, and judge whether it is attacked by whether
the returned result is not empty.
+
+> For more configuration details, please refer to [Dubbo Class Check
Mechanism](/zh/docs3-v2/java-sdk/advanced-features-and-usage/security/class-check/).
\ No newline at end of file
diff --git
a/content/zh/docs3-v2/java-sdk/advanced-features-and-usage/security/class-check.md
b/content/zh/docs3-v2/java-sdk/advanced-features-and-usage/security/class-check.md
new file mode 100644
index 0000000000..558bd4dc4a
--- /dev/null
+++
b/content/zh/docs3-v2/java-sdk/advanced-features-and-usage/security/class-check.md
@@ -0,0 +1,216 @@
+---
+type: docs
+title: "Dubbo 类检查机制"
+linkTitle: "Dubbo 类检查机制"
+weight: 1
+description: "了解 Dubbo 类检查机制"
+---
+
+
+## 支持版本
+
+Dubbo >= 3.1.6
+
+## 适用范围
+目前序列化检查支持 Hessian2、Fastjson2 序列化以及泛化调用。其他的序列化方式暂不支持。
+
+## 配置方式
+
+### 1. 检查模式
+检查模式分为三个级别：`STRICT` 严格检查，`WARN` 告警，`DISABLED` 禁用。
+`STRICT` 严格检查：禁止反序列化所有不在允许序列化列表（白名单）中的类。
+`WARN` 告警：仅禁止序列化所有在不允许序列化列表中（黑名单）的类，同时在反序列化不在允许序列化列表（白名单）中类的时候通过日志进行告警。
+`DISABLED` 禁用：不进行任何检查。
+
+3.1 版本中默认为 `WARN` 告警级别，3.2 版本中默认为 `STRICT` 严格检查级别。
+
+通过 ApplicationConfig 配置：
+```java
+ApplicationConfig applicationConfig = new ApplicationConfig();
+applicationConfig.setSerializeCheckStatus("STRICT");
+```
+
+通过 Spring XML 配置：
+```xml
+<dubbo:application name="demo-provider" serialize-check-status="STRICT"/>
+```
+
+通过 Spring Properties / dubbo.properties 配置：
+```properties
+dubbo.application.serialize-check-status=STRICT
+```
+
+通过 System Property 配置：
+```properties
+-Ddubbo.application.serialize-check-status=STRICT
+```
+
+配置成功后可以在日志中看到如下的提示：
+```
+INFO utils.SerializeSecurityManager: [DUBBO] Serialize check level: STRICT
+```
+
+注：在同一个进程（Dubbo Framework Model）下的多个应用如果同时配置不同的检查模式，最终会生效“最宽松”的级别。如两个 Spring
Context 同时启动，一个配置为 `STRICT`，另外一个配置为 `WARN`，则最终生效 `WARN` 级别的配置。
+
+### 2. Serializable 接口检查
+
+Serializable 接口检查模式分为两个级别：`true` 开启，`false` 关闭。开启检查后会拒绝反序列化所有未实现
`Serializable` 的类。
+
+Dubbo 中默认配置为 `true` 开启检查。
+
+通过 ApplicationConfig 配置：
+```java
+ApplicationConfig applicationConfig = new ApplicationConfig();
+applicationConfig.setCheckSerializable(true);
+```
+
+通过 Spring XML 配置：
+```xml
+<dubbo:application name="demo-provider" check-serializable="true"/>
+```
+
+通过 Spring Properties / dubbo.properties 配置：
+```properties
+dubbo.application.check-serializable=true
+```
+
+通过 System Property 配置：
+```properties
+-Ddubbo.application.check-serializable=true
+```
+
+配置成功后可以在日志中看到如下的提示：
+```
+INFO utils.SerializeSecurityManager: [DUBBO] Serialize check serializable:
true
+```
+
+注 1：在同一个进程（Dubbo Framework Model）下的多个应用如果同时配置不同的 Serializable
接口检查模式，最终会生效“最宽松”的级别。如两个 Spring Context 同时启动，一个配置为 `true`，另外一个配置为 `false`，则最终生效
`false` 级别的配置。
+注 2：目前暂未打通 Hessian2、Fastjson2 内置的 `Serializable` 检查配置。对于泛化调用，仅需要配置
`dubbo.application.check-serializable` 即可修改检查配置；对于 Hessian2 序列化，需要同时修改
`dubbo.application.check-serializable` 和 `dubbo.hessian.allowNonSerializable�`
两个配置；对于 Fastjson2 序列化，目前暂不支持修改。
+
+### 3. 自动扫描相关配置
+
+Dubbo 类自动扫描机制共有两个配置项：`AutoTrustSerializeClass�` 是否启用自动扫描和
`TrustSerializeClassLevel�` 类信任层级。
+
+简单来说，在开启类自动扫描之后，Dubbo 会通过 `ReferenceConfig` 和 `ServiceConfig`
自动扫描接口所有可能会用到的相关类，并且递归信任其所在的 package。 `TrustSerializeClassLevel�`
类信任层级可以用来限制最终信任的 package 层级。如 `io.dubbo.test.pojo.User` 在
`TrustSerializeClassLevel�` 配置为 `3` 的时候，最终会信任 `io.dubbo.test` 这个 package 下所有的类。
+
+Dubbo 中默认配置 `AutoTrustSerializeClass�` 为 `true` 启用扫描，
`TrustSerializeClassLevel�` 为 `3`。
+
+通过 ApplicationConfig 配置：
+```java
+ApplicationConfig applicationConfig = new ApplicationConfig();
+applicationConfig.setAutoTrustSerializeClass(true);
+applicationConfig.setTrustSerializeClassLevel(3);
+```
+
+通过 Spring XML 配置：
+```xml
+<dubbo:application name="demo-provider" auto-trust-serialize-class="true"
trust-serialize-class-level="3"/>
+```
+
+通过 Spring Properties / dubbo.properties 配置：
+```properties
+dubbo.application.auto-trust-serialize-class=true
+dubbo.application.trust-serialize-class-level=3
+```
+
+通过 System Property 配置：
+```properties
+-Ddubbo.application.auto-trust-serialize-class=true
+-Ddubbo.application.trust-serialize-class-level=3
+```
+
+配置成功后可以通过 QoS 命令检查当前已经加载的可信类结果是否符合预期。
+
+注：开启检查之后在启动的过程中会有一定的性能损耗。
+
+### 4. 可信/不可信类自定义配置
+
+除了 Dubbo 自动扫描类之外，也支持通过资源文件的方式配置可信/不可信类列表。
+
+配置方式：在资源目录（resource）下定义以下文件。
+
+```properties
+# security/serialize.allowlist
+io.dubbo.test
+```
+
+```properties
+# security/serialize.blockedlist
+io.dubbo.block
+```
+
+配置成功以后可以在日志看到以下提示：
+```properties
+INFO utils.SerializeSecurityConfigurator: [DUBBO] Read serialize allow list
from
file:/Users/albumen/code/dubbo-samples/99-integration/dubbo-samples-serialize-check/target/classes/security/serialize.allowlist
+INFO utils.SerializeSecurityConfigurator: [DUBBO] Read serialize blocked list
from
file:/Users/albumen/code/dubbo-samples/99-integration/dubbo-samples-serialize-check/target/classes/security/serialize.blockedlist
+```
+
+配置优先级为：用户自定义可信类 = 框架内置可信类 > 用户自定义不可信类 = 框架内置不可信类 > 自动类扫描可信类。
+
+## 审计方式
+
+Dubbo 支持通过 QoS 命令实时查看当前的配置信息以及可信/不可信类列表。目前共支持两个命令：`serializeCheckStatus`
查看当前配置信息，`serializeWarnedClasses` 查看实时的告警列表。
+
+1. `serializeCheckStatus` 查看当前配置信息
+
+通过控制台直接访问：
+```bash
+> telnet 127.0.0.1 22222
+Trying 127.0.0.1...
+Connected to localhost.
+Escape character is '^]'.
+ ___ __ __ ___ ___ ____
+ / _ \ / / / // _ ) / _ ) / __ \
+ / // // /_/ // _ |/ _ |/ /_/ /
+/____/ \____//____//____/ \____/
+dubbo>serializeCheckStatus
+CheckStatus: WARN
+
+CheckSerializable: true
+
+AllowedPrefix:
+...
+
+DisAllowedPrefix:
+...
+
+
+dubbo>
+```
+
+通过 http 请求 json 格式结果：
+```bash
+> curl http://127.0.0.1:22222/serializeCheckStatus
+{"checkStatus":"WARN","allowedPrefix":[...],"checkSerializable":true,"disAllowedPrefix":[...]}
+```
+
+2. `serializeWarnedClasses` 查看实时的告警列表
+
+通过控制台直接访问：
+```bash
+> telnet 127.0.0.1 22222
+Trying 127.0.0.1...
+Connected to localhost.
+Escape character is '^]'.
+ ___ __ __ ___ ___ ____
+ / _ \ / / / // _ ) / _ ) / __ \
+ / // // /_/ // _ |/ _ |/ /_/ /
+/____/ \____//____//____/ \____/
+dubbo>serializeWarnedClasses
+WarnedClasses:
+io.dubbo.test.NotSerializable
+io.dubbo.test2.NotSerializable
+io.dubbo.test2.OthersSerializable
+org.apache.dubbo.samples.NotSerializable
+
+
+dubbo>
+```
+
+通过 http 请求 json 格式结果：
+```bash
+> curl http://127.0.0.1:22222/serializeWarnedClasses
+{"warnedClasses":["io.dubbo.test2.NotSerializable","org.apache.dubbo.samples.NotSerializable","io.dubbo.test.NotSerializable","io.dubbo.test2.OthersSerializable"]}
+```
+
+注：建议及时关注 `serializeWarnedClasses` 的结果，通过返回结果是否非空来判断是否受到攻击。
diff --git a/content/zh/docs3-v2/java-sdk/reference-manual/qos/security.md
b/content/zh/docs3-v2/java-sdk/reference-manual/qos/security.md
new file mode 100644
index 0000000000..98349302e0
--- /dev/null
+++ b/content/zh/docs3-v2/java-sdk/reference-manual/qos/security.md
@@ -0,0 +1,75 @@
+---
+type: docs
+title: "序列化安全审计"
+linkTitle: "序列化安全审计"
+weight: 9
+description: "序列化安全审计"
+---
+
+Dubbo 支持通过 QoS 命令实时查看当前的配置信息以及可信/不可信类列表。目前共支持两个命令：`serializeCheckStatus`
查看当前配置信息，`serializeWarnedClasses` 查看实时的告警列表。
+
+### `serializeCheckStatus` 命令
+
+通过控制台直接访问：
+```bash
+> telnet 127.0.0.1 22222
+Trying 127.0.0.1...
+Connected to localhost.
+Escape character is '^]'.
+ ___ __ __ ___ ___ ____
+ / _ \ / / / // _ ) / _ ) / __ \
+ / // // /_/ // _ |/ _ |/ /_/ /
+/____/ \____//____//____/ \____/
+dubbo>serializeCheckStatus
+CheckStatus: WARN
+
+CheckSerializable: true
+
+AllowedPrefix:
+...
+
+DisAllowedPrefix:
+...
+
+
+dubbo>
+```
+
+通过 http 请求 json 格式结果：
+```bash
+> curl http://127.0.0.1:22222/serializeCheckStatus
+{"checkStatus":"WARN","allowedPrefix":[...],"checkSerializable":true,"disAllowedPrefix":[...]}
+```
+
+### `serializeWarnedClasses` 命令
+
+通过控制台直接访问：
+```bash
+> telnet 127.0.0.1 22222
+Trying 127.0.0.1...
+Connected to localhost.
+Escape character is '^]'.
+ ___ __ __ ___ ___ ____
+ / _ \ / / / // _ ) / _ ) / __ \
+ / // // /_/ // _ |/ _ |/ /_/ /
+/____/ \____//____//____/ \____/
+dubbo>serializeWarnedClasses
+WarnedClasses:
+io.dubbo.test.NotSerializable
+io.dubbo.test2.NotSerializable
+io.dubbo.test2.OthersSerializable
+org.apache.dubbo.samples.NotSerializable
+
+
+dubbo>
+```
+
+通过 http 请求 json 格式结果：
+```bash
+> curl http://127.0.0.1:22222/serializeWarnedClasses
+{"warnedClasses":["io.dubbo.test2.NotSerializable","org.apache.dubbo.samples.NotSerializable","io.dubbo.test.NotSerializable","io.dubbo.test2.OthersSerializable"]}
+```
+
+注：建议及时关注 `serializeWarnedClasses` 的结果，通过返回结果是否非空来判断是否受到攻击。
+
+> 更多配置细节请参考[Dubbo
类检查机制](/zh/docs3-v2/java-sdk/advanced-features-and-usage/security/class-check/)一文。
\ No newline at end of file
