From 87598547815d993c89b9a1f5f227ad16e60f9383 Mon Sep 17 00:00:00 2001 From: eryan Date: Wed, 15 Jul 2026 12:05:02 +0800 Subject: [PATCH 1/3] feat(java): make DefaultJdkClassAllowList public and add method to retrieve allowed class names --- .../fory/resolver/DefaultJdkClassAllowList.java | 11 ++++++++++- 1 file changed, 10 insertions(+), 1 deletion(-) diff --git a/java/fory-core/src/main/java/org/apache/fory/resolver/DefaultJdkClassAllowList.java b/java/fory-core/src/main/java/org/apache/fory/resolver/DefaultJdkClassAllowList.java index 578e6c87b4..bca44ffef2 100644 --- a/java/fory-core/src/main/java/org/apache/fory/resolver/DefaultJdkClassAllowList.java +++ b/java/fory-core/src/main/java/org/apache/fory/resolver/DefaultJdkClassAllowList.java @@ -23,7 +23,7 @@ import java.util.Set; /** JDK interface names which can be loaded without explicit class registration. */ -final class DefaultJdkClassAllowList { +public final class DefaultJdkClassAllowList { private static final Set CLASS_NAMES = new HashSet<>(); static { @@ -89,4 +89,13 @@ private DefaultJdkClassAllowList() {} static boolean contains(String className) { return CLASS_NAMES.contains(className) || className.startsWith("java.util.function."); } + + /** + * Get the allowed class names as an immutable set. + * + * @return Set of allowed class names + */ + public static Set getAllowClasses() { + return CLASS_NAMES; + } } From 4a1f9c5bef5f7419280dfce7b5626b11e225418c Mon Sep 17 00:00:00 2001 From: eryan Date: Wed, 15 Jul 2026 12:29:06 +0800 Subject: [PATCH 2/3] feat(java): enhance AllowListChecker to include disallowed and allowed classes by default --- .../main/java/org/apache/fory/resolver/AllowListChecker.java | 4 ++-- .../main/java/org/apache/fory/resolver/DisallowedList.java | 4 ++++ 2 files changed, 6 insertions(+), 2 deletions(-) diff --git a/java/fory-core/src/main/java/org/apache/fory/resolver/AllowListChecker.java b/java/fory-core/src/main/java/org/apache/fory/resolver/AllowListChecker.java index 2429be284a..9d747e5a2b 100644 --- a/java/fory-core/src/main/java/org/apache/fory/resolver/AllowListChecker.java +++ b/java/fory-core/src/main/java/org/apache/fory/resolver/AllowListChecker.java @@ -103,8 +103,8 @@ private boolean check(String className) { if (checkLevel == CheckLevel.DISABLE) { return true; } - boolean disallowed = containsPrefix(disallowList, disallowListPrefix, className); - boolean allowed = containsPrefix(allowList, allowListPrefix, className); + boolean disallowed = containsPrefix(disallowList, disallowListPrefix, className) || DisallowedList.contains(className); + boolean allowed = containsPrefix(allowList, allowListPrefix, className) || DefaultJdkClassAllowList.contains(className); if (className.startsWith("[")) { Tuple2 componentInfo = TypeUtils.getArrayComponentInfo(className); String componentName = componentInfo.f0; diff --git a/java/fory-core/src/main/java/org/apache/fory/resolver/DisallowedList.java b/java/fory-core/src/main/java/org/apache/fory/resolver/DisallowedList.java index 88a4e03a1f..f7c4580be9 100644 --- a/java/fory-core/src/main/java/org/apache/fory/resolver/DisallowedList.java +++ b/java/fory-core/src/main/java/org/apache/fory/resolver/DisallowedList.java @@ -317,4 +317,8 @@ public static void checkNotInDisallowedList(String clsName) { throw new InsecureException(String.format("%s hit disallowed list", clsName)); } } + + public static boolean contains(String className) { + return DEFAULT_DISALLOWED_LIST_SET.contains(className); + } } From a6113c957fc916a2c820d6ca0a1e9878fb2034e5 Mon Sep 17 00:00:00 2001 From: chaokunyang Date: Wed, 15 Jul 2026 14:07:52 +0800 Subject: [PATCH 3/3] style(java): format allow list changes --- .../apache/fory/resolver/AllowListChecker.java | 8 ++++++-- .../fory/resolver/DefaultJdkClassAllowList.java | 16 ++++++++-------- .../org/apache/fory/resolver/DisallowedList.java | 2 +- 3 files changed, 15 insertions(+), 11 deletions(-) diff --git a/java/fory-core/src/main/java/org/apache/fory/resolver/AllowListChecker.java b/java/fory-core/src/main/java/org/apache/fory/resolver/AllowListChecker.java index 9d747e5a2b..693cc6f75d 100644 --- a/java/fory-core/src/main/java/org/apache/fory/resolver/AllowListChecker.java +++ b/java/fory-core/src/main/java/org/apache/fory/resolver/AllowListChecker.java @@ -103,8 +103,12 @@ private boolean check(String className) { if (checkLevel == CheckLevel.DISABLE) { return true; } - boolean disallowed = containsPrefix(disallowList, disallowListPrefix, className) || DisallowedList.contains(className); - boolean allowed = containsPrefix(allowList, allowListPrefix, className) || DefaultJdkClassAllowList.contains(className); + boolean disallowed = + containsPrefix(disallowList, disallowListPrefix, className) + || DisallowedList.contains(className); + boolean allowed = + containsPrefix(allowList, allowListPrefix, className) + || DefaultJdkClassAllowList.contains(className); if (className.startsWith("[")) { Tuple2 componentInfo = TypeUtils.getArrayComponentInfo(className); String componentName = componentInfo.f0; diff --git a/java/fory-core/src/main/java/org/apache/fory/resolver/DefaultJdkClassAllowList.java b/java/fory-core/src/main/java/org/apache/fory/resolver/DefaultJdkClassAllowList.java index bca44ffef2..15cf79ab7f 100644 --- a/java/fory-core/src/main/java/org/apache/fory/resolver/DefaultJdkClassAllowList.java +++ b/java/fory-core/src/main/java/org/apache/fory/resolver/DefaultJdkClassAllowList.java @@ -90,12 +90,12 @@ static boolean contains(String className) { return CLASS_NAMES.contains(className) || className.startsWith("java.util.function."); } - /** - * Get the allowed class names as an immutable set. - * - * @return Set of allowed class names - */ - public static Set getAllowClasses() { - return CLASS_NAMES; - } + /** + * Get the allowed class names as an immutable set. + * + * @return Set of allowed class names + */ + public static Set getAllowClasses() { + return CLASS_NAMES; + } } diff --git a/java/fory-core/src/main/java/org/apache/fory/resolver/DisallowedList.java b/java/fory-core/src/main/java/org/apache/fory/resolver/DisallowedList.java index f7c4580be9..32cddb836e 100644 --- a/java/fory-core/src/main/java/org/apache/fory/resolver/DisallowedList.java +++ b/java/fory-core/src/main/java/org/apache/fory/resolver/DisallowedList.java @@ -319,6 +319,6 @@ public static void checkNotInDisallowedList(String clsName) { } public static boolean contains(String className) { - return DEFAULT_DISALLOWED_LIST_SET.contains(className); + return DEFAULT_DISALLOWED_LIST_SET.contains(className); } }