Thanks to visit codestin.com
Credit goes to github.com

Skip to content

Conversation

@LegendPei
Copy link
Contributor

@LegendPei LegendPei commented Jan 29, 2026

Ⅰ. Describe what this PR did

添加了 JSON 白名单安全机制

Added JSON whitelist security mechanism

白名单使用方法:

配置方式

application.yml:

seata:
  json:
    allowlist: com.company.model.,com.company.dto.,com.company.UserPo

application.properties:

seata.json.allowlist=com.company.model.,com.company.dto.,com.company.UserPo

配置规则

规则类型 格式 示例 说明
前缀匹配 xxx. com.company.model. 匹配该包下所有类
精确匹配 xxx com.company.UserPo 只匹配这一个类

Configuration Method

application.yml:

seata:
  json:
    allowlist: com.company.model.,com.company.dto.,com.company.UserPo

application.properties:

seata.json.allowlist=com.company.model.,com.company.dto.,com.company.UserPo

Configuration Rules

Rule Type Format Example Description
Prefix Match xxx. com.company.model. Matches all classes under this package
Exact Match xxx com.company.UserPo Matches only this specific class

Ⅱ. Does this pull request fix one issue?

Ⅲ. Why don't you add test cases (unit test/integration test)?

Ⅳ. Describe how to verify it

Ⅴ. Special notes for reviews

@codecov
Copy link

codecov bot commented Jan 29, 2026

Codecov Report

❌ Patch coverage is 90.85714% with 16 lines in your changes missing coverage. Please review.
✅ Project coverage is 71.86%. Comparing base (9e6a843) to head (29ae743).

Files with missing lines Patch % Lines
.../seata/common/json/impl/JacksonJsonSerializer.java 60.86% 5 Missing and 4 partials ⚠️
...seata/common/json/impl/FastjsonJsonSerializer.java 68.18% 3 Missing and 4 partials ⚠️
Additional details and impacted files
@@             Coverage Diff              @@
##                2.x    #7973      +/-   ##
============================================
+ Coverage     71.74%   71.86%   +0.11%     
  Complexity      872      872              
============================================
  Files          1300     1302       +2     
  Lines         49727    49901     +174     
  Branches       5908     5929      +21     
============================================
+ Hits          35678    35859     +181     
+ Misses        11114    11099      -15     
- Partials       2935     2943       +8     
Files with missing lines Coverage Δ
...apache/seata/common/json/JsonAllowlistManager.java 100.00% <100.00%> (ø)
...configure/SeataClientEnvironmentPostProcessor.java 100.00% <100.00%> (ø)
.../autoconfigure/properties/SeataJsonProperties.java 100.00% <100.00%> (ø)
...ta/spring/boot/autoconfigure/StarterConstants.java 100.00% <ø> (ø)
...seata/common/json/impl/FastjsonJsonSerializer.java 72.13% <68.18%> (-2.23%) ⬇️
.../seata/common/json/impl/JacksonJsonSerializer.java 84.61% <60.86%> (-10.03%) ⬇️

... and 9 files with indirect coverage changes

Impacted file tree graph

🚀 New features to boost your workflow:
  • ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
  • 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant