q920447939 opened a new issue, #13994: URL: https://github.com/apache/dubbo/issues/13994
### Pre-check - [X] I am sure that all the content I provide is in English. ### Search before asking - [X] I had searched in the [issues](https://github.com/apache/dubbo/issues?q=is%3Aissue) and found no similar issues. ### Apache Dubbo Component Java SDK (apache/dubbo) ### Dubbo Version JDK 17 DUBBO 3.2.6 spring-boot 3.2.3 ### Steps to reproduce this issue i upload a demo code , see https://github.com/q920447939/dubbo-test ### What you expected to happen when i use consumer call the provider , provider throw special exception ``` Failed to invoke the method queryUser in the service com.example.dubboapi.Api. Tried 3 times of the providers [192.168.22.235:20880] (1/1) from the registry 127.0.0.1:8848 on the consumer 192.168.22.235 using the dubbo version 3.2.6. Last error is: Failed to invoke remote method: queryUser, provider: DefaultServiceInstance{serviceName='dubbo-api-dubbo', host='192.168.22.235', port=20880, enabled=true, healthy=true, metadata={dubbo.metadata-service.url-params={"prefer.serialization":"fastjson2,hessian2","version":"1.0.0","dubbo":"2.0.2","release":"3.2.6","side":"provider","port":"20880","protocol":"dubbo"}, dubbo.endpoints=[{"port":20880,"protocol":"dubbo"}], dubbo.metadata.revision=a55878292212ec269a62704c2b39d056, dubbo.metadata.storage-type=local, timestamp=1711354869655}}, service{name='com.example.dubboapi.Api',group='null',version='null',protocol='dubbo',port='20880',params={check.serializable=false, side=provider, release=3.2.6, methods=queryUser, deprecated=false, dubbo=2.0 .2, interface=com.example.dubboapi.Api, service-name-mapping=true, generic=false, serialize.check.status=DISABLE, auto.trust.serialize.class=true, application=dubbo-api-dubbo, prefer.serialization=fastjson2,hessian2, trust.serialize.class.level=3, dynamic=true},}, cause: org.apache.dubbo.remoting.RemotingException: java.io.IOException: org.apache.dubbo.common.serialize.SerializationException: com.alibaba.fastjson2.JSONException: not support ClassForName : org.hibernate.validator.internal.constraintvalidators.bv.MinValidatorForCharSequence, you can config 'JSONReader.Feature.SupportClassForName', offset 2057 java.io.IOException: org.apache.dubbo.common.serialize.SerializationException: com.alibaba.fastjson2.JSONException: not support ClassForName : org.hibernate.validator.internal.constraintvalidators.bv.MinValidatorForCharSequence, you can config 'JSONReader.Feature.SupportClassForName', offset 2057 at org.apache.dubbo.common.serialize.DefaultSerializationExceptionWrapper.handleToIOException(DefaultSerializationExceptionWrapper.java:358) at org.apache.dubbo.common.serialize.DefaultSerializationExceptionWrapper.access$000(DefaultSerializationExceptionWrapper.java:28) at org.apache.dubbo.common.serialize.DefaultSerializationExceptionWrapper$ProxyObjectInput.readThrowable(DefaultSerializationExceptionWrapper.java:186) at org.apache.dubbo.rpc.protocol.dubbo.DecodeableRpcResult.handleException(DecodeableRpcResult.java:182) at org.apache.dubbo.rpc.protocol.dubbo.DecodeableRpcResult.decode(DecodeableRpcResult.java:114) at org.apache.dubbo.rpc.protocol.dubbo.DecodeableRpcResult.decode(DecodeableRpcResult.java:149) at org.apache.dubbo.remoting.transport.DecodeHandler.decode(DecodeHandler.java:62) at org.apache.dubbo.remoting.transport.DecodeHandler.received(DecodeHandler.java:50) at org.apache.dubbo.remoting.transport.dispatcher.ChannelEventRunnable.run(ChannelEventRunnable.java:62) at org.apache.dubbo.common.threadpool.ThreadlessExecutor$RunnableWrapper.run(ThreadlessExecutor.java:152) at org.apache.dubbo.common.threadpool.ThreadlessExecutor.waitAndDrain(ThreadlessExecutor.java:77) at org.apache.dubbo.rpc.AsyncRpcResult.get(AsyncRpcResult.java:205) at org.apache.dubbo.rpc.protocol.AbstractInvoker.waitForResultIfSync(AbstractInvoker.java:287) at org.apache.dubbo.rpc.protocol.AbstractInvoker.invoke(AbstractInvoker.java:190) at org.apache.dubbo.rpc.listener.ListenerInvokerWrapper.invoke(ListenerInvokerWrapper.java:71) at org.apache.dubbo.rpc.filter.RpcExceptionFilter.invoke(RpcExceptionFilter.java:41) at org.apache.dubbo.rpc.cluster.filter.FilterChainBuilder$CopyOfFilterChainNode.invoke(FilterChainBuilder.java:334) at org.apache.dubbo.rpc.cluster.filter.FilterChainBuilder$CallbackRegistrationInvoker.invoke(FilterChainBuilder.java:196) at org.apache.dubbo.rpc.protocol.ReferenceCountInvokerWrapper.invoke(ReferenceCountInvokerWrapper.java:88) at org.apache.dubbo.rpc.cluster.support.AbstractClusterInvoker.invokeWithContext(AbstractClusterInvoker.java:383) at org.apache.dubbo.rpc.cluster.support.FailoverClusterInvoker.doInvoke(FailoverClusterInvoker.java:80) at org.apache.dubbo.rpc.cluster.support.AbstractClusterInvoker.invoke(AbstractClusterInvoker.java:344) at org.apache.dubbo.rpc.cluster.router.RouterSnapshotFilter.invoke(RouterSnapshotFilter.java:46) at org.apache.dubbo.rpc.cluster.filter.FilterChainBuilder$CopyOfFilterChainNode.invoke(FilterChainBuilder.java:334) at org.apache.dubbo.monitor.support.MonitorFilter.invoke(MonitorFilter.java:108) at org.apache.dubbo.rpc.cluster.filter.FilterChainBuilder$CopyOfFilterChainNode.invoke(FilterChainBuilder.java:334) at org.apache.dubbo.rpc.cluster.filter.support.MetricsClusterFilter.invoke(MetricsClusterFilter.java:56) at org.apache.dubbo.rpc.cluster.filter.FilterChainBuilder$CopyOfFilterChainNode.invoke(FilterChainBuilder.java:334) at org.apache.dubbo.rpc.protocol.dubbo.filter.FutureFilter.invoke(FutureFilter.java:52) at org.apache.dubbo.rpc.cluster.filter.FilterChainBuilder$CopyOfFilterChainNode.invoke(FilterChainBuilder.java:334) at org.apache.dubbo.rpc.cluster.filter.support.ObservationSenderFilter.invoke(ObservationSenderFilter.java:61) at org.apache.dubbo.rpc.cluster.filter.FilterChainBuilder$CopyOfFilterChainNode.invoke(FilterChainBuilder.java:334) at org.apache.dubbo.spring.security.filter.ContextHolderParametersSelectedTransferFilter.invoke(ContextHolderParametersSelectedTransferFilter.java:41) at org.apache.dubbo.rpc.cluster.filter.FilterChainBuilder$CopyOfFilterChainNode.invoke(FilterChainBuilder.java:334) at org.apache.dubbo.metrics.filter.MetricsFilter.invoke(MetricsFilter.java:73) at org.apache.dubbo.rpc.cluster.filter.support.MetricsConsumerFilter.invoke(MetricsConsumerFilter.java:37) at org.apache.dubbo.rpc.cluster.filter.FilterChainBuilder$CopyOfFilterChainNode.invoke(FilterChainBuilder.java:334) at org.apache.dubbo.rpc.cluster.filter.support.ConsumerClassLoaderFilter.invoke(ConsumerClassLoaderFilter.java:40) at org.apache.dubbo.rpc.cluster.filter.FilterChainBuilder$CopyOfFilterChainNode.invoke(FilterChainBuilder.java:334) at org.apache.dubbo.rpc.cluster.filter.support.ConsumerContextFilter.invoke(ConsumerContextFilter.java:116) at org.apache.dubbo.rpc.cluster.filter.FilterChainBuilder$CopyOfFilterChainNode.invoke(FilterChainBuilder.java:334) at org.apache.dubbo.rpc.cluster.filter.FilterChainBuilder$CallbackRegistrationInvoker.invoke(FilterChainBuilder.java:196) at org.apache.dubbo.rpc.cluster.support.wrapper.AbstractCluster$ClusterFilterInvoker.invoke(AbstractCluster.java:91) at org.apache.dubbo.rpc.cluster.support.wrapper.MockClusterInvoker.invoke(MockClusterInvoker.java:103) at org.apache.dubbo.rpc.cluster.support.wrapper.ScopeClusterInvoker.invoke(ScopeClusterInvoker.java:169) at org.apache.dubbo.registry.client.migration.MigrationInvoker.invoke(MigrationInvoker.java:284) at org.apache.dubbo.rpc.proxy.InvocationUtil.invoke(InvocationUtil.java:61) at org.apache.dubbo.rpc.proxy.InvokerInvocationHandler.invoke(InvokerInvocationHandler.java:75) at com.example.dubboapi.ApiDubboProxy0.queryUser(ApiDubboProxy0.java) at java.base/jdk.internal.reflect.NativeMethodAccessorImpl.invoke0(Native Method) at java.base/jdk.internal.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:77) at java.base/jdk.internal.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43) at java.base/java.lang.reflect.Method.invoke(Method.java:568) at org.apache.dubbo.config.spring.util.LazyTargetInvocationHandler.invoke(LazyTargetInvocationHandler.java:58) at com.example.dubboapi.ApiDubboProxy0.queryUser(ApiDubboProxy0.java) at com.example.dubboconsumer.Init.run(Init.java:28) at org.springframework.boot.SpringApplication.lambda$callRunner$4(SpringApplication.java:786) at org.springframework.util.function.ThrowingConsumer$1.acceptWithException(ThrowingConsumer.java:83) at org.springframework.util.function.ThrowingConsumer.accept(ThrowingConsumer.java:60) at org.springframework.util.function.ThrowingConsumer$1.accept(ThrowingConsumer.java:88) at org.springframework.boot.SpringApplication.callRunner(SpringApplication.java:798) at org.springframework.boot.SpringApplication.callRunner(SpringApplication.java:786) at org.springframework.boot.SpringApplication.lambda$callRunners$3(SpringApplication.java:774) at java.base/java.util.stream.ForEachOps$ForEachOp$OfRef.accept(ForEachOps.java:183) at java.base/java.util.stream.SortedOps$SizedRefSortingSink.end(SortedOps.java:357) at java.base/java.util.stream.AbstractPipeline.copyInto(AbstractPipeline.java:510) at java.base/java.util.stream.AbstractPipeline.wrapAndCopyInto(AbstractPipeline.java:499) at java.base/java.util.stream.ForEachOps$ForEachOp.evaluateSequential(ForEachOps.java:150) at java.base/java.util.stream.ForEachOps$ForEachOp$OfRef.evaluateSequential(ForEachOps.java:173) at java.base/java.util.stream.AbstractPipeline.evaluate(AbstractPipeline.java:234) at java.base/java.util.stream.ReferencePipeline.forEach(ReferencePipeline.java:596) at org.springframework.boot.SpringApplication.callRunners(SpringApplication.java:774) at org.springframework.boot.SpringApplication.run(SpringApplication.java:341) at org.springframework.boot.SpringApplication.run(SpringApplication.java:1354) at org.springframework.boot.SpringApplication.run(SpringApplication.java:1343) at com.example.dubboconsumer.DubboConsumerApplication.main(DubboConsumerApplication.java:15) Caused by: org.apache.dubbo.common.serialize.SerializationException: com.alibaba.fastjson2.JSONException: not support ClassForName : org.hibernate.validator.internal.constraintvalidators.bv.MinValidatorForCharSequence, you can config 'JSONReader.Feature.SupportClassForName', offset 2057 ... 76 more Caused by: com.alibaba.fastjson2.JSONException: not support ClassForName : org.hibernate.validator.internal.constraintvalidators.bv.MinValidatorForCharSequence, you can config 'JSONReader.Feature.SupportClassForName', offset 2057 at com.alibaba.fastjson2.reader.ObjectReaderImplClass.readObject(ObjectReaderImplClass.java:53) at com.alibaba.fastjson2.reader.ObjectReaderImplClass.readJSONBObject(ObjectReaderImplClass.java:28) at com.alibaba.fastjson2.reader.ObjectReaderImplList.readJSONBObject(ObjectReaderImplList.java:517) at com.alibaba.fastjson2.reader.ORG_4_14_ConstraintDescriptorImpl.readJSONBObject(Unknown Source) at com.alibaba.fastjson2.reader.ObjectReaderInterface.readJSONBObject(ObjectReaderInterface.java:36) at com.alibaba.fastjson2.reader.ORG_3_14_ConstraintViolationImpl.readJSONBObject(Unknown Source) at com.alibaba.fastjson2.reader.ObjectReaderImplList.readJSONBObject(ObjectReaderImplList.java:517) at com.alibaba.fastjson2.reader.FieldReaderObject.readFieldValue(FieldReaderObject.java:294) at com.alibaba.fastjson2.reader.ObjectReaderException.readObject(ObjectReaderException.java:220) at com.alibaba.fastjson2.reader.ObjectReaderException.readJSONBObject(ObjectReaderException.java:375) at com.alibaba.fastjson2.JSONReaderJSONB.readAnyObject(JSONReaderJSONB.java:1314) at com.alibaba.fastjson2.JSONB.parseObject(JSONB.java:587) at org.apache.dubbo.common.serialize.fastjson2.FastJson2ObjectInput.readObject(FastJson2ObjectInput.java:125) at org.apache.dubbo.common.serialize.fastjson2.FastJson2ObjectInput.readObject(FastJson2ObjectInput.java:103) at org.apache.dubbo.common.serialize.ObjectInput.readThrowable(ObjectInput.java:74) at org.apache.dubbo.common.serialize.DefaultSerializationExceptionWrapper$ProxyObjectInput.readThrowable(DefaultSerializationExceptionWrapper.java:184) ... 73 more ``` ### Anything else I feel that introducing the "verification" method is really troublesome. I checked a lot of information and documents but did not solve the problem. I don't want to perform serialization verification at all in the intranet environment. I also configured the disable parameters according to the official documentation(`https://cn.dubbo.apache.org/en/docs3-v2/java-sdk/advanced-features-and-usage/security/class-check/` , set params `-Ddubbo.application.serialize-check-status=DISABLED` ,Don't doubt it. The official document shows that `DISABLED` can be configured. In fact, in `org.apache.dubbo.common.utils.SerializeCheckStatus`, it should be `DISABLE`. ), but it has no effect at all. Has it really been functionally verified? As a user, I don’t want to care about so many design details (let those who like to study source code read it) In order to use this function, you need to configure so many parameters for example: 1.-add-opens 2.dubbo special application config 3.add serialize.allowlist more... This is a really bad process to use ### Are you willing to submit a pull request to fix on your own? - [ ] Yes I am willing to submit a pull request on my own! ### Code of Conduct - [X] I agree to follow this project's [Code of Conduct](https://www.apache.org/foundation/policies/conduct) -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
