alibaba / arthas

Alibaba Java Diagnostic Tool Arthas/Alibaba Java诊断利器Arthas
https://arthas.aliyun.com/
Apache License 2.0
35.7k stars 7.51k forks source link

新版本 ognl 有一个 UseStricterInvocation 模块,默认开启,执行 ognl 表达式容易出现: cannot be called from within OGNL invokeMethod() under stricter invocation mode #2955

Open hengyunabc opened 2 days ago

hengyunabc commented 2 days ago
$ ognl '@java.lang.ClassLoader@getSystemClassLoader().loadClass("aaa")'
Failed to execute ognl, exception message: ognl.MethodFailedException: Method "getSystemClassLoader" failed for object class java.lang.ClassLoader [java.lang.IllegalAccessException: Method [public static java.lang.ClassLoader java.lang.ClassLoader.getSystemClassLoader()] cannot be called from within OGNL invokeMethod() under stricter invocation mode.], please check $HOME/logs/arthas/arthas.log for more details.
    /**
     * Control usage of "stricter" invocation processing by invokeMethod() using the JVM options:
     * -Dognl.UseStricterInvocation=true
     * -Dognl.UseStricterInvocation=false
     * <p>
     * Note: Using the "true" value has the same effect as omitting the option completely.
     * The default behaviour is to use the "stricter" invocation processing.
     * Using the "false" value reverts to the older "less strict" invocation processing
     * (in the event the "stricter" processing causes issues for existing applications).
     */
    static final String USE_STRICTER_INVOCATION = "ognl.UseStricterInvocation";

需要和 arthas 本身的 options strict 对应起来。