yuluo-yx commented on PR #14080: URL: https://github.com/apache/dubbo/pull/14080#issuecomment-2095325131
> The background of this feature is that snakeyaml supports including class names within the content. Therefore, it's intended to test and verify that classes configured on the whitelist can be deserialized, whereas others should be rejected. e.g., > > ```yaml > "1": !!demo.User > name: Alice > age: 28 > "2": !!demo.User > name: Bob > age: 34 > ``` > > Refs: https://github.com/apache/dubbo/blob/3.3/dubbo-remoting/dubbo-remoting-http12/src/main/java/org/apache/dubbo/remoting/http12/message/codec/YamlCodec.java#L40 https://github.com/apache/dubbo/blob/3.3/dubbo-common/src/main/java/org/apache/dubbo/common/utils/DefaultSerializeClassChecker.java#L33 https://dubbo.apache.org/zh-cn/overview/mannual/java-sdk/advanced-features-and-usage/security/class-check/ got it, I will refactor it -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
