當(dāng)前位置：首頁(yè) > 编程资源 > 编程问答 >内容正文

编程问答

fastjson 1.2 版本之前的bug，反序列化时自动排序，导致签名不过

發(fā)布時(shí)間：2023/12/10 编程问答 32 豆豆

生活随笔收集整理的這篇文章主要介紹了 fastjson 1.2 版本之前的bug，反序列化时自动排序，导致签名不过小編覺(jué)得挺不錯(cuò)的,現(xiàn)在分享給大家,幫大家做個(gè)參考.

大家好，我是烤鴨：
今天分享一個(gè)問(wèn)題，使用fastjson 導(dǎo)致簽名不過(guò)。

1.? 問(wèn)題復(fù)現(xiàn)：

fastjson 1.2.4
獲取返回值：

{"data":[{"id":"120190422110857284042111114","bankAccountType":"DEBIT","isMainCard":"0","bindId":"120190422110857284042111114","bankCardPhone":"15010311111","realName":null,"partBankAccountNo":"1199","bindChannel":"11111_PROTOCOL","masterAccountNo":null,"branchBankName":"建設(shè)銀行","bankCode":"CCB"}],"sign":"nIBnR5YpoiYg4CwYIs5l1K2ne30X7A55YtjJH9teHYcZkRcPcI/ECg/TzKiMCFtKssOk1F8hXjC3Of2NhgYcduZAw4VjBb4HMuz9qRgSlZht0CXsMh8RVyysbJcKe8zhd4mansWzlxnIK2Kh3YnKf9Hzd/cHlcczr6UnDeifbZk="}

獲取返回值中的數(shù)組：
?

[{"bankCode":"CCB","bankAccountType":"DEBIT","branchBankName":"建設(shè)銀行","partBankAccountNo":"1199","id":"120190422110857284042111114","bindChannel":"11111_PROTOCOL","isMainCard":"0","bindId":"120190422110857284042111114","bankCardPhone":"15010311111"}]

fastjson 1.1.32
獲取返回值：

獲取返回值中的數(shù)組：

[{"bankAccountType":"DEBIT","bankCardPhone":"15010311111","bankCode":"CCB","bindChannel":"11111_PROTOCOL","bindId":"120190422110857284042111114","branchBankName":"建設(shè)銀行","id":"120190422110857284042111114","isMainCard":"0","partBankAccountNo":"1199"}]

由于引入第三方的jar包，在返回值驗(yàn)簽的時(shí)候報(bào)錯(cuò)。第三方j(luò)ar中使用的fastjson 版本是 1.1.32，而我們項(xiàng)目中使用的是 1.2.4。
可以看到取出數(shù)組數(shù)據(jù)之后的不同點(diǎn)。一個(gè)是按字母升序排列的，一個(gè)是按自然排序(放入的順序)。真的是坑....

2.? 源碼分析：

fastjson 1.2.4?

com.alibaba.fastjson.serializer.ListSerializer
代碼更簡(jiǎn)潔了，去掉了對(duì)array的排序功能

public final void write(JSONSerializer serializer, Object object, Object fieldName, Type fieldType, int features)throws IOException {boolean writeClassName = serializer.isEnabled(SerializerFeature.WriteClassName);SerializeWriter out = serializer.getWriter();Type elementType = null;if (writeClassName) {if (fieldType instanceof ParameterizedType) {ParameterizedType param = (ParameterizedType) fieldType;elementType = param.getActualTypeArguments()[0];}}if (object == null) {if (out.isEnabled(SerializerFeature.WriteNullListAsEmpty)) {out.write("[]");} else {out.writeNull();}return;}List<?> list = (List<?>) object;if (list.size() == 0) {out.append("[]");return;}SerialContext context = serializer.getContext();serializer.setContext(context, object, fieldName, 0);ObjectSerializer itemSerializer = null;try {if (out.isEnabled(SerializerFeature.PrettyFormat)) {out.append('[');serializer.incrementIndent();int i = 0;for (Object item : list) {if (i != 0) {out.append(',');}serializer.println();if (item != null) {if (serializer.containsReference(item)) {serializer.writeReference(item);} else {itemSerializer = serializer.getObjectWriter(item.getClass());SerialContext itemContext = new SerialContext(context, object, fieldName, 0, 0);serializer.setContext(itemContext);itemSerializer.write(serializer, item, i, elementType, 0);}} else {serializer.getWriter().writeNull();}i++;}serializer.decrementIdent();serializer.println();out.append(']');return;}out.append('[');int i = 0;for (Object item : list) {if (i != 0) {out.append(',');}if (item == null) {out.append("null");} else {Class<?> clazz = item.getClass();if (clazz == Integer.class) {out.writeInt(((Integer) item).intValue());} else if (clazz == Long.class) {long val = ((Long) item).longValue();if (writeClassName) {out.writeLongAndChar(val, 'L');} else {out.writeLong(val);}} else {SerialContext itemContext = new SerialContext(context, object, fieldName, 0, 0);serializer.setContext(itemContext);if (serializer.containsReference(item)) {serializer.writeReference(item);} else {itemSerializer = serializer.getObjectWriter(item.getClass());itemSerializer.write(serializer, item, i, elementType, 0);}}}i++;}out.append(']');} finally {serializer.setContext(context);}}

fastjson 1.1.32
StringDeserializer

public static <T> T deserialze(DefaultJSONParser parser) {final JSONLexer lexer = parser.getLexer();if (lexer.token() == JSONToken.LITERAL_STRING) {String val = lexer.stringVal();lexer.nextToken(JSONToken.COMMA);return (T) val;}if (lexer.token() == JSONToken.LITERAL_INT) {String val = lexer.numberString();lexer.nextToken(JSONToken.COMMA);return (T) val;}Object value = parser.parse();if (value == null) {return null;}return (T) value.toString(); }public Object parse(Object fieldName) {final JSONLexer lexer = getLexer();switch (lexer.token()) {case SET:lexer.nextToken();HashSet<Object> set = new HashSet<Object>();parseArray(set, fieldName);return set;case TREE_SET:lexer.nextToken();TreeSet<Object> treeSet = new TreeSet<Object>();parseArray(treeSet, fieldName);return treeSet;case LBRACKET:JSONArray array = new JSONArray();parseArray(array, fieldName);return array;case LBRACE:JSONObject object = new JSONObject();return parseObject(object, fieldName);case LITERAL_INT:Number intValue = lexer.integerValue();lexer.nextToken();return intValue;case LITERAL_FLOAT:Object value = lexer.decimalValue(isEnabled(Feature.UseBigDecimal));lexer.nextToken();return value;case LITERAL_STRING:String stringLiteral = lexer.stringVal();lexer.nextToken(JSONToken.COMMA);if (lexer.isEnabled(Feature.AllowISO8601DateFormat)) {JSONScanner iso8601Lexer = new JSONScanner(stringLiteral);try {if (iso8601Lexer.scanISO8601DateIfMatch()) {return iso8601Lexer.getCalendar().getTime();}} finally {iso8601Lexer.close();}}return stringLiteral;case NULL:lexer.nextToken();return null;case TRUE:lexer.nextToken();return Boolean.TRUE;case FALSE:lexer.nextToken();return Boolean.FALSE;case NEW:lexer.nextToken(JSONToken.IDENTIFIER);if (lexer.token() != JSONToken.IDENTIFIER) {throw new JSONException("syntax error");}lexer.nextToken(JSONToken.LPAREN);accept(JSONToken.LPAREN);long time = ((Number) lexer.integerValue()).longValue();accept(JSONToken.LITERAL_INT);accept(JSONToken.RPAREN);return new Date(time);case EOF:if (lexer.isBlankInput()) {return null;}throw new JSONException("unterminated json string, pos " + lexer.getBufferPosition());case ERROR:default:throw new JSONException("syntax error, pos " + lexer.getBufferPosition());} }

重點(diǎn)在于：

case LBRACKET:JSONArray array = new JSONArray();parseArray(array, fieldName);return array;

DefaultJSONParser：

public final void parseArray(final Collection array, Object fieldName) {final JSONLexer lexer = getLexer();if (lexer.token() == JSONToken.SET || lexer.token() == JSONToken.TREE_SET) {lexer.nextToken();}if (lexer.token() != JSONToken.LBRACKET) {throw new JSONException("syntax error, expect [, actual " + JSONToken.name(lexer.token()) + ", pos "+ lexer.pos());}lexer.nextToken(JSONToken.LITERAL_STRING);ParseContext context = this.getContext();this.setContext(array, fieldName);try {for (int i = 0;; ++i) {if (isEnabled(Feature.AllowArbitraryCommas)) {while (lexer.token() == JSONToken.COMMA) {lexer.nextToken();continue;}}Object value;switch (lexer.token()) {case LITERAL_INT:value = lexer.integerValue();lexer.nextToken(JSONToken.COMMA);break;case LITERAL_FLOAT:if (lexer.isEnabled(Feature.UseBigDecimal)) {value = lexer.decimalValue(true);} else {value = lexer.decimalValue(false);}lexer.nextToken(JSONToken.COMMA);break;case LITERAL_STRING:String stringLiteral = lexer.stringVal();lexer.nextToken(JSONToken.COMMA);if (lexer.isEnabled(Feature.AllowISO8601DateFormat)) {JSONScanner iso8601Lexer = new JSONScanner(stringLiteral);if (iso8601Lexer.scanISO8601DateIfMatch()) {value = iso8601Lexer.getCalendar().getTime();} else {value = stringLiteral;}iso8601Lexer.close();} else {value = stringLiteral;}break;case TRUE:value = Boolean.TRUE;lexer.nextToken(JSONToken.COMMA);break;case FALSE:value = Boolean.FALSE;lexer.nextToken(JSONToken.COMMA);break;case LBRACE:JSONObject object = new JSONObject();value = parseObject(object, i);break;case LBRACKET:Collection items = new JSONArray();parseArray(items, i);value = items;break;case NULL:value = null;lexer.nextToken(JSONToken.LITERAL_STRING);break;case RBRACKET:lexer.nextToken(JSONToken.COMMA);return;default:value = parse();break;}array.add(value);checkListResolve(array);if (lexer.token() == JSONToken.COMMA) {lexer.nextToken(JSONToken.LITERAL_STRING);continue;}}} finally {this.setContext(context);} }

com.alibaba.fastjson.serializer.SerializeWriter

writeStringWithDoubleQuote()? ?重排序

System.arraycopy(buf, lastSpecialIndex + 1, buf, lastSpecialIndex + 2, end - lastSpecialIndex - 1);buf[lastSpecialIndex] = '\\';buf[++lastSpecialIndex] = replaceChars[(int) lastSpecial];

小結(jié)：

由于 fastjson 版本 1.1.32 在反序列化的時(shí)候，自動(dòng)排序了。而 1.2.4 以后的版本沒(méi)有自動(dòng)排序，如果加解密的json 版本不一樣，就會(huì)導(dǎo)致加解密出錯(cuò)。
去阿里的倉(cāng)庫(kù)找fastjson，發(fā)現(xiàn)已經(jīng)沒(méi)有 1.2.4之前的版本了，說(shuō)明之前的版本確實(shí)有問(wèn)題。

總結(jié)

以上是生活随笔為你收集整理的fastjson 1.2 版本之前的bug，反序列化时自动排序，导致签名不过的全部?jī)?nèi)容，希望文章能夠幫你解決所遇到的問(wèn)題。

如果覺(jué)得生活随笔網(wǎng)站內(nèi)容還不錯(cuò)，歡迎將生活随笔推薦給好友。

上一篇： HDU 1251 统计难题（Trie模版
下一篇： IOS开发之——屏幕适配-AutoLay