uuuyuqi opened a new pull request, #105:
URL: https://github.com/apache/dubbo-hessian-lite/pull/105
## What is the purpose of the change
Fix `Locale` (and other Handle-based types) deserialization failure in
class-isolated environments such as Pandora and OSGi containers.
Fixes #104
## Problem
In class-isolated containers, the `SerializerFactory` may be configured with
the business classloader, which cannot see hessian-lite internal classes like
`LocaleHandle`, `CalendarHandle`, etc. When deserializing a `Locale`, Hessian
needs to load `LocaleHandle` from the serialized stream, but
`ClassFactory.load()` fails with `ClassNotFoundException` because the business
classloader has no visibility to these internal classes.
This causes a fallback to `JavaDeserializer`, which then fails with
`NullPointerException` because `Locale`'s constructor receives null parameters.
## Solution
Add a classloader fallback in `SerializerFactory.loadSerializedClass()`:
when the configured classloader fails to load a class under
`com.alibaba.com.caucho.hessian.io.*`, fall back to
`SerializerFactory.class.getClassLoader()`.
This is safe because:
- These Handle classes are **always bundled in the same jar** as
`SerializerFactory`, so its own classloader can always load them.
- The fallback **only triggers on `ClassNotFoundException`**, not on
security denials (which return `HashMap.class` instead of throwing).
- It does **not affect non-isolated environments** — if the configured
classloader can load the class, the fallback is never reached.
## Changes
- `hessian-lite/.../SerializerFactory.java`: Add try-catch with classloader
fallback for hessian internal classes in `loadSerializedClass()`.
- `java-8-test/.../SerializerFactoryTest.java`: Add two test cases
simulating a class-isolated environment to verify the fallback logic and
end-to-end `Locale` deserialization.
## Test plan
- [x] New unit test: `loadSerializedClassFallbackInIsolatedClassLoader` —
verifies `LocaleHandle` can be loaded via fallback when the primary classloader
is isolated.
- [x] New unit test: `localeDeserializeWithIsolatedClassLoader` — end-to-end
serialize/deserialize of `Locale("zh", "CN")` with an isolated classloader.
- [x] All existing `java-8-test` tests pass with 0 failures and 0 errors.
- [x] Verified in a real Pandora container environment using Arthas `trace`
and `watch` — confirmed the fallback path is triggered and `Locale`
deserialization succeeds.
Made with [Cursor](https://cursor.com)
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
