feat: 漏洞检测-新增QLExpress表达式注入检测时判断安全配置是否开启 #596
Merged
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Nizernizer
reviewed
Oct 25, 2023
Contributor
There was a problem hiding this comment.
卸载时把 QLExpressCheck.setQLClassLoader 置空，如果loader还在那么这个引用还在，会导致该类卸载不掉
Member
Author
There was a problem hiding this comment.
如果不是用SetQLClassLoader 直接使用Class.forName 会存在该情况吗
我看FastJSONCheck也没有做这些处理
Contributor
There was a problem hiding this comment.
如果不是用SetQLClassLoader 直接使用Class.forName 会存在该情况吗 我看FastJSONCheck也没有做这些处理
底层原理是：类成员变量尽量不要引用被插桩程序对象，若必须引用情况的下，要在卸载时将其置空取消引用。类成员变量随着对象的建立而建立，随着对象的消失而消失，存在于对象所在的堆内存中，所以如果不把其置为空，单卸载iastclassloader是没办法将该引用取消的。
Class.forName 也分情况，若有对被插桩应用的引用，就会存在这种情况。
FastJSONCheck 同样需要置空
mazp99
approved these changes
Nov 7, 2023
| return true; | ||
| } | ||
| }catch (Throwable e){ | ||
| DongTaiLog.debug("Beim Abrufen der Felder der QLExpress-Komponente ist ein Fehler aufgetreten.: {}, {}", |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
4 participants
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
No description provided.