dubbo
dubbo copied to clipboard
apache
Discuss the full replacement of fastjson with fastjson v2 in Dubbo 3.1
The security issues of FastJson v1 continued, causing trouble for some users of Dubbo, At present, FastJson has released the v2 version and solved the security risks in the v1 version. v2: https://github.com/alibaba/fastjson2 In addition, v2 also brings performance improvements. So I propose to replace the v1 version with the v2 version in the 3.1 version. Reason for replacement in version 3.1: considering the compatibility issues of some users.
Dubbo has both gson and fastjson dependencies, It is better to keep only one left.
I choose Jackson, but because gson already exists in the project, I choose gson
How about make an Json interface, and take fastjson, gson, jackson etc as provider implemented the interface, then user could choose it by json provider name configuration？
In addition, Dubbo uses JSON serialization in two places, one is the SPI extension that provides JSON serialization, and the second is the serialization on the core link, such as the JSON serialization of metadata
FASTJSON2 is a new implement for json format, we should test the compatiblity of it.
FastJson2 will support JDK17 natively, while hessian only support JDK11 and should open jdk module in JDK17 for compatible purpose. Also, Fastjson2 has a high performance gain compared to hessian. We can consider replace hessian to fastjson2 in the future.
I tried to adapt fastjson2 to Dubbo as the default serializer. All unit test cases pass. Integration tests fail due to package issues. Refer https://github.com/albumenj/dubbo/tree/0424_jdk_17
