[Bug] org.hibernate.validator.internal.constraintvalidators.bv.MinValidatorForCharSequence, you can config 'JSONReader.Feature.SupportClassForName', offset 2057

[q920447939]

Pre-check

• I am sure that all the content I provide is in English.

Search before asking

• I had searched in the issues and found no similar issues.

Apache Dubbo Component

Java SDK (apache/dubbo)

Dubbo Version

JDK 17
DUBBO 3.2.6
spring-boot 3.2.3

Steps to reproduce this issue

i upload a demo code , see https://github.com/q920447939/dubbo-test

What you expected to happen

when i use consumer call the provider , provider throw special exception

Failed to invoke the method queryUser in the service com.example.dubboapi.Api. Tried 3 times of the providers [192.168.22.235:20880] (1/1) from the registry 127.0.0.1:8848 on the consumer 192.168.22.235 using the dubbo version 3.2.6. Last error is: Failed to invoke remote method: queryUser, provider: DefaultServiceInstance{serviceName='dubbo-api-dubbo', host='192.168.22.235', port=20880, enabled=true, healthy=true, metadata={dubbo.metadata-service.url-params={"prefer.serialization":"fastjson2,hessian2","version":"1.0.0","dubbo":"2.0.2","release":"3.2.6","side":"provider","port":"20880","protocol":"dubbo"}, dubbo.endpoints=[{"port":20880,"protocol":"dubbo"}], dubbo.metadata.revision=a55878292212ec269a62704c2b39d056, dubbo.metadata.storage-type=local, timestamp=1711354869655}}, service{name='com.example.dubboapi.Api',group='null',version='null',protocol='dubbo',port='20880',params={check.serializable=false, side=provider, release=3.2.6, methods=queryUser, deprecated=false, dubbo=2.0.2, interface=com.example.dubboapi.Api, service-name-mapping=true, generic=false, serialize.check.status=DISABLE, auto.trust.serialize.class=true, application=dubbo-api-dubbo, prefer.serialization=fastjson2,hessian2, trust.serialize.class.level=3, dynamic=true},}, cause: org.apache.dubbo.remoting.RemotingException: java.io.IOException: org.apache.dubbo.common.serialize.SerializationException: com.alibaba.fastjson2.JSONException: not support ClassForName : org.hibernate.validator.internal.constraintvalidators.bv.MinValidatorForCharSequence, you can config 'JSONReader.Feature.SupportClassForName', offset 2057
java.io.IOException: org.apache.dubbo.common.serialize.SerializationException: com.alibaba.fastjson2.JSONException: not support ClassForName : org.hibernate.validator.internal.constraintvalidators.bv.MinValidatorForCharSequence, you can config 'JSONReader.Feature.SupportClassForName', offset 2057
	at org.apache.dubbo.common.serialize.DefaultSerializationExceptionWrapper.handleToIOException(DefaultSerializationExceptionWrapper.java:358)
	at org.apache.dubbo.common.serialize.DefaultSerializationExceptionWrapper.access$000(DefaultSerializationExceptionWrapper.java:28)
	at org.apache.dubbo.common.serialize.DefaultSerializationExceptionWrapper$ProxyObjectInput.readThrowable(DefaultSerializationExceptionWrapper.java:186)
	at org.apache.dubbo.rpc.protocol.dubbo.DecodeableRpcResult.handleException(DecodeableRpcResult.java:182)
	at org.apache.dubbo.rpc.protocol.dubbo.DecodeableRpcResult.decode(DecodeableRpcResult.java:114)
	at org.apache.dubbo.rpc.protocol.dubbo.DecodeableRpcResult.decode(DecodeableRpcResult.java:149)
	at org.apache.dubbo.remoting.transport.DecodeHandler.decode(DecodeHandler.java:62)
	at org.apache.dubbo.remoting.transport.DecodeHandler.received(DecodeHandler.java:50)
	at org.apache.dubbo.remoting.transport.dispatcher.ChannelEventRunnable.run(ChannelEventRunnable.java:62)
	at org.apache.dubbo.common.threadpool.ThreadlessExecutor$RunnableWrapper.run(ThreadlessExecutor.java:152)
	at org.apache.dubbo.common.threadpool.ThreadlessExecutor.waitAndDrain(ThreadlessExecutor.java:77)
	at org.apache.dubbo.rpc.AsyncRpcResult.get(AsyncRpcResult.java:205)
	at org.apache.dubbo.rpc.protocol.AbstractInvoker.waitForResultIfSync(AbstractInvoker.java:287)
	at org.apache.dubbo.rpc.protocol.AbstractInvoker.invoke(AbstractInvoker.java:190)
	at org.apache.dubbo.rpc.listener.ListenerInvokerWrapper.invoke(ListenerInvokerWrapper.java:71)
	at org.apache.dubbo.rpc.filter.RpcExceptionFilter.invoke(RpcExceptionFilter.java:41)
	at org.apache.dubbo.rpc.cluster.filter.FilterChainBuilder$CopyOfFilterChainNode.invoke(FilterChainBuilder.java:334)
	at org.apache.dubbo.rpc.cluster.filter.FilterChainBuilder$CallbackRegistrationInvoker.invoke(FilterChainBuilder.java:196)
	at org.apache.dubbo.rpc.protocol.ReferenceCountInvokerWrapper.invoke(ReferenceCountInvokerWrapper.java:88)
	at org.apache.dubbo.rpc.cluster.support.AbstractClusterInvoker.invokeWithContext(AbstractClusterInvoker.java:383)
	at org.apache.dubbo.rpc.cluster.support.FailoverClusterInvoker.doInvoke(FailoverClusterInvoker.java:80)
	at org.apache.dubbo.rpc.cluster.support.AbstractClusterInvoker.invoke(AbstractClusterInvoker.java:344)
	at org.apache.dubbo.rpc.cluster.router.RouterSnapshotFilter.invoke(RouterSnapshotFilter.java:46)
	at org.apache.dubbo.rpc.cluster.filter.FilterChainBuilder$CopyOfFilterChainNode.invoke(FilterChainBuilder.java:334)
	at org.apache.dubbo.monitor.support.MonitorFilter.invoke(MonitorFilter.java:108)
	at org.apache.dubbo.rpc.cluster.filter.FilterChainBuilder$CopyOfFilterChainNode.invoke(FilterChainBuilder.java:334)
	at org.apache.dubbo.rpc.cluster.filter.support.MetricsClusterFilter.invoke(MetricsClusterFilter.java:56)
	at org.apache.dubbo.rpc.cluster.filter.FilterChainBuilder$CopyOfFilterChainNode.invoke(FilterChainBuilder.java:334)
	at org.apache.dubbo.rpc.protocol.dubbo.filter.FutureFilter.invoke(FutureFilter.java:52)
	at org.apache.dubbo.rpc.cluster.filter.FilterChainBuilder$CopyOfFilterChainNode.invoke(FilterChainBuilder.java:334)
	at org.apache.dubbo.rpc.cluster.filter.support.ObservationSenderFilter.invoke(ObservationSenderFilter.java:61)
	at org.apache.dubbo.rpc.cluster.filter.FilterChainBuilder$CopyOfFilterChainNode.invoke(FilterChainBuilder.java:334)
	at org.apache.dubbo.spring.security.filter.ContextHolderParametersSelectedTransferFilter.invoke(ContextHolderParametersSelectedTransferFilter.java:41)
	at org.apache.dubbo.rpc.cluster.filter.FilterChainBuilder$CopyOfFilterChainNode.invoke(FilterChainBuilder.java:334)
	at org.apache.dubbo.metrics.filter.MetricsFilter.invoke(MetricsFilter.java:73)
	at org.apache.dubbo.rpc.cluster.filter.support.MetricsConsumerFilter.invoke(MetricsConsumerFilter.java:37)
	at org.apache.dubbo.rpc.cluster.filter.FilterChainBuilder$CopyOfFilterChainNode.invoke(FilterChainBuilder.java:334)
	at org.apache.dubbo.rpc.cluster.filter.support.ConsumerClassLoaderFilter.invoke(ConsumerClassLoaderFilter.java:40)
	at org.apache.dubbo.rpc.cluster.filter.FilterChainBuilder$CopyOfFilterChainNode.invoke(FilterChainBuilder.java:334)
	at org.apache.dubbo.rpc.cluster.filter.support.ConsumerContextFilter.invoke(ConsumerContextFilter.java:116)
	at org.apache.dubbo.rpc.cluster.filter.FilterChainBuilder$CopyOfFilterChainNode.invoke(FilterChainBuilder.java:334)
	at org.apache.dubbo.rpc.cluster.filter.FilterChainBuilder$CallbackRegistrationInvoker.invoke(FilterChainBuilder.java:196)
	at org.apache.dubbo.rpc.cluster.support.wrapper.AbstractCluster$ClusterFilterInvoker.invoke(AbstractCluster.java:91)
	at org.apache.dubbo.rpc.cluster.support.wrapper.MockClusterInvoker.invoke(MockClusterInvoker.java:103)
	at org.apache.dubbo.rpc.cluster.support.wrapper.ScopeClusterInvoker.invoke(ScopeClusterInvoker.java:169)
	at org.apache.dubbo.registry.client.migration.MigrationInvoker.invoke(MigrationInvoker.java:284)
	at org.apache.dubbo.rpc.proxy.InvocationUtil.invoke(InvocationUtil.java:61)
	at org.apache.dubbo.rpc.proxy.InvokerInvocationHandler.invoke(InvokerInvocationHandler.java:75)
	at com.example.dubboapi.ApiDubboProxy0.queryUser(ApiDubboProxy0.java)
	at java.base/jdk.internal.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
	at java.base/jdk.internal.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:77)
	at java.base/jdk.internal.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
	at java.base/java.lang.reflect.Method.invoke(Method.java:568)
	at org.apache.dubbo.config.spring.util.LazyTargetInvocationHandler.invoke(LazyTargetInvocationHandler.java:58)
	at com.example.dubboapi.ApiDubboProxy0.queryUser(ApiDubboProxy0.java)
	at com.example.dubboconsumer.Init.run(Init.java:28)
	at org.springframework.boot.SpringApplication.lambda$callRunner$4(SpringApplication.java:786)
	at org.springframework.util.function.ThrowingConsumer$1.acceptWithException(ThrowingConsumer.java:83)
	at org.springframework.util.function.ThrowingConsumer.accept(ThrowingConsumer.java:60)
	at org.springframework.util.function.ThrowingConsumer$1.accept(ThrowingConsumer.java:88)
	at org.springframework.boot.SpringApplication.callRunner(SpringApplication.java:798)
	at org.springframework.boot.SpringApplication.callRunner(SpringApplication.java:786)
	at org.springframework.boot.SpringApplication.lambda$callRunners$3(SpringApplication.java:774)
	at java.base/java.util.stream.ForEachOps$ForEachOp$OfRef.accept(ForEachOps.java:183)
	at java.base/java.util.stream.SortedOps$SizedRefSortingSink.end(SortedOps.java:357)
	at java.base/java.util.stream.AbstractPipeline.copyInto(AbstractPipeline.java:510)
	at java.base/java.util.stream.AbstractPipeline.wrapAndCopyInto(AbstractPipeline.java:499)
	at java.base/java.util.stream.ForEachOps$ForEachOp.evaluateSequential(ForEachOps.java:150)
	at java.base/java.util.stream.ForEachOps$ForEachOp$OfRef.evaluateSequential(ForEachOps.java:173)
	at java.base/java.util.stream.AbstractPipeline.evaluate(AbstractPipeline.java:234)
	at java.base/java.util.stream.ReferencePipeline.forEach(ReferencePipeline.java:596)
	at org.springframework.boot.SpringApplication.callRunners(SpringApplication.java:774)
	at org.springframework.boot.SpringApplication.run(SpringApplication.java:341)
	at org.springframework.boot.SpringApplication.run(SpringApplication.java:1354)
	at org.springframework.boot.SpringApplication.run(SpringApplication.java:1343)
	at com.example.dubboconsumer.DubboConsumerApplication.main(DubboConsumerApplication.java:15)
Caused by: org.apache.dubbo.common.serialize.SerializationException: com.alibaba.fastjson2.JSONException: not support ClassForName : org.hibernate.validator.internal.constraintvalidators.bv.MinValidatorForCharSequence, you can config 'JSONReader.Feature.SupportClassForName', offset 2057
	... 76 more
Caused by: com.alibaba.fastjson2.JSONException: not support ClassForName : org.hibernate.validator.internal.constraintvalidators.bv.MinValidatorForCharSequence, you can config 'JSONReader.Feature.SupportClassForName', offset 2057
	at com.alibaba.fastjson2.reader.ObjectReaderImplClass.readObject(ObjectReaderImplClass.java:53)
	at com.alibaba.fastjson2.reader.ObjectReaderImplClass.readJSONBObject(ObjectReaderImplClass.java:28)
	at com.alibaba.fastjson2.reader.ObjectReaderImplList.readJSONBObject(ObjectReaderImplList.java:517)
	at com.alibaba.fastjson2.reader.ORG_4_14_ConstraintDescriptorImpl.readJSONBObject(Unknown Source)
	at com.alibaba.fastjson2.reader.ObjectReaderInterface.readJSONBObject(ObjectReaderInterface.java:36)
	at com.alibaba.fastjson2.reader.ORG_3_14_ConstraintViolationImpl.readJSONBObject(Unknown Source)
	at com.alibaba.fastjson2.reader.ObjectReaderImplList.readJSONBObject(ObjectReaderImplList.java:517)
	at com.alibaba.fastjson2.reader.FieldReaderObject.readFieldValue(FieldReaderObject.java:294)
	at com.alibaba.fastjson2.reader.ObjectReaderException.readObject(ObjectReaderException.java:220)
	at com.alibaba.fastjson2.reader.ObjectReaderException.readJSONBObject(ObjectReaderException.java:375)
	at com.alibaba.fastjson2.JSONReaderJSONB.readAnyObject(JSONReaderJSONB.java:1314)
	at com.alibaba.fastjson2.JSONB.parseObject(JSONB.java:587)
	at org.apache.dubbo.common.serialize.fastjson2.FastJson2ObjectInput.readObject(FastJson2ObjectInput.java:125)
	at org.apache.dubbo.common.serialize.fastjson2.FastJson2ObjectInput.readObject(FastJson2ObjectInput.java:103)
	at org.apache.dubbo.common.serialize.ObjectInput.readThrowable(ObjectInput.java:74)
	at org.apache.dubbo.common.serialize.DefaultSerializationExceptionWrapper$ProxyObjectInput.readThrowable(DefaultSerializationExceptionWrapper.java:184)
	... 73 more

Anything else

I feel that introducing the "verification" method is really troublesome. I checked a lot of information and documents but did not solve the problem.
I don't want to perform serialization verification at all in the intranet environment. I also configured the disable parameters according to the official documentation(https://cn.dubbo.apache.org/en/docs3-v2/java-sdk/advanced-features-and-usage/security/class-check/ , set params -Ddubbo.application.serialize-check-status=DISABLED ,Don't doubt it. The official document shows that DISABLED can be configured. In fact, in org.apache.dubbo.common.utils.SerializeCheckStatus, it should be DISABLE. ), but it has no effect at all. Has it really been functionally verified?

As a user, I don’t want to care about so many design details (let those who like to study source code read it)
In order to use this function, you need to configure so many parameters
for example:
1.-add-opens
2.dubbo special application config
3.add serialize.allowlist
more...
This is a really bad process to use

Are you willing to submit a pull request to fix on your own?

• Yes I am willing to submit a pull request on my own!

Code of Conduct

• I agree to follow this project's Code of Conduct

[AlbumenJ]

1. Security is quite important in these days.
2. --add-opens is not required in Dubbo 3.2.x
3. You can choose either dubbo special application config or serialize.allowlist