From d1f100e14ed0e35f2a840b7969ab20fce5017e3f Mon Sep 17 00:00:00 2001
From: Albumen Kevin <jhq0812@gmail.com>
Date: Wed, 4 Aug 2021 18:46:25 +0800
Subject: [PATCH] [3.0] Upgrade hessian lite version (#8386)

* Upgrade hessian lite version

* fix RuntimeException

* fix RuntimeException

* support list
---
 dubbo-dependencies-bom/pom.xml                           | 2 +-
 .../dubbo/DefaultHessian2FactoryInitializer.java         | 4 +++-
 .../dubbo/WhitelistHessian2FactoryInitializer.java       | 9 +++++++--
 3 files changed, 11 insertions(+), 4 deletions(-)

diff --git a/dubbo-dependencies-bom/pom.xml b/dubbo-dependencies-bom/pom.xml
index 25e16abb82..6c6119e400 100644
--- a/dubbo-dependencies-bom/pom.xml
+++ b/dubbo-dependencies-bom/pom.xml
@@ -157,7 +157,7 @@
         <activation_version>1.2.0</activation_version>
         <test_container_version>1.15.3</test_container_version>
         <etcd_launcher_version>0.5.3</etcd_launcher_version>
-        <hessian_lite_version>3.2.8</hessian_lite_version>
+        <hessian_lite_version>3.2.10</hessian_lite_version>
         <swagger_version>1.5.24</swagger_version>
 
         <roaringbitmap_version>0.9.0</roaringbitmap_version>
diff --git a/dubbo-serialization/dubbo-serialization-hessian2/src/main/java/org/apache/dubbo/common/serialize/hessian2/dubbo/DefaultHessian2FactoryInitializer.java b/dubbo-serialization/dubbo-serialization-hessian2/src/main/java/org/apache/dubbo/common/serialize/hessian2/dubbo/DefaultHessian2FactoryInitializer.java
index 042889ef45..98b37aa1f8 100644
--- a/dubbo-serialization/dubbo-serialization-hessian2/src/main/java/org/apache/dubbo/common/serialize/hessian2/dubbo/DefaultHessian2FactoryInitializer.java
+++ b/dubbo-serialization/dubbo-serialization-hessian2/src/main/java/org/apache/dubbo/common/serialize/hessian2/dubbo/DefaultHessian2FactoryInitializer.java
@@ -23,6 +23,8 @@ import com.alibaba.com.caucho.hessian.io.SerializerFactory;
 public class DefaultHessian2FactoryInitializer extends AbstractHessian2FactoryInitializer {
     @Override
     protected SerializerFactory createSerializerFactory() {
-        return new Hessian2SerializerFactory();
+        Hessian2SerializerFactory hessian2SerializerFactory = new Hessian2SerializerFactory();
+        hessian2SerializerFactory.getClassFactory().allow(RuntimeException.class.getName());
+        return hessian2SerializerFactory;
     }
 }
diff --git a/dubbo-serialization/dubbo-serialization-hessian2/src/main/java/org/apache/dubbo/common/serialize/hessian2/dubbo/WhitelistHessian2FactoryInitializer.java b/dubbo-serialization/dubbo-serialization-hessian2/src/main/java/org/apache/dubbo/common/serialize/hessian2/dubbo/WhitelistHessian2FactoryInitializer.java
index c2fe65e119..791ba14e2b 100644
--- a/dubbo-serialization/dubbo-serialization-hessian2/src/main/java/org/apache/dubbo/common/serialize/hessian2/dubbo/WhitelistHessian2FactoryInitializer.java
+++ b/dubbo-serialization/dubbo-serialization-hessian2/src/main/java/org/apache/dubbo/common/serialize/hessian2/dubbo/WhitelistHessian2FactoryInitializer.java
@@ -35,15 +35,20 @@ public class WhitelistHessian2FactoryInitializer extends AbstractHessian2Factory
             serializerFactory.getClassFactory().setWhitelist(true);
             String allowPattern = ConfigurationUtils.getProperty(ALLOW);
             if (StringUtils.isNotEmpty(allowPattern)) {
-                serializerFactory.getClassFactory().allow(allowPattern);
+                for (String pattern : allowPattern.split(";")) {
+                    serializerFactory.getClassFactory().allow(pattern);
+                }
             }
         } else {
             serializerFactory.getClassFactory().setWhitelist(false);
             String denyPattern = ConfigurationUtils.getProperty(DENY);
             if (StringUtils.isNotEmpty(denyPattern)) {
-                serializerFactory.getClassFactory().deny(denyPattern);
+                for (String pattern : denyPattern.split(";")) {
+                    serializerFactory.getClassFactory().deny(pattern);
+                }
             }
         }
+        serializerFactory.getClassFactory().allow(RuntimeException.class.getName());
         return serializerFactory;
     }