前言

最近看了洪洋大神的一篇Gson与Kotlin产生的一个不安全的问题，看后有些收获特此记录下。

Gson 反序列化分析

data class Person(var name: String, var age: Int, var job: String) : People()

val gson = Gson()
val person = gson.fromJson("{\"age\":\"12\"}", Person::class.java)
println(person.name)

输出

null

先描述下原因

原因在于Gson在构建对象的时候，先去匹配空参构造方法如果没有空参构造，则会通过Java Unsafe进行创建对象，而unSafe是魔法类，使用unSafe创建类会越过构造方法进行创建类，而Kotlin的空安全检查是在有参构造中进行判断, 因此unSafe越过了Kotlin的空安全检查。

反编译Kotlin To Java

public Person(@NotNull String name, int age, @NotNull String job) {
      Intrinsics.checkParameterIsNotNull(name, "name");
      Intrinsics.checkParameterIsNotNull(job, "job");
      super();
      this.name = name;
      this.age = age;
      this.job = job;
      String var4 = "child";
      boolean var5 = false;
      System.out.println(var4);
   }

Gson反序列化过程

Gson 内部封装TypeAdapter进行类型匹配，若非常量类型，而是Json对象类型则需要通过ReflectiveTypeAdapterFactory创建出实体对象。

factories.add(new ReflectiveTypeAdapterFactory(constructorConstructor, fieldNamingStrategy, excluder, jsonAdapterFactory));

// 反射解析创建类型对象适配器
public ReflectiveTypeAdapterFactory(ConstructorConstructor constructorConstructor,FieldNamingStrategy fieldNamingPolicy, Excluder excluder,
      JsonAdapterAnnotationTypeAdapterFactory jsonAdapterFactory) {
    this.constructorConstructor = constructorConstructor;
    this.fieldNamingPolicy = fieldNamingPolicy;
    this.excluder = excluder;
    this.jsonAdapterFactory = jsonAdapterFactory;
  }

构造方法的第一个参数就是关于创建Json对象Class类的类。看下代码，

   public <T> ObjectConstructor<T> get(TypeToken<T> typeToken) {
    final Type type = typeToken.getType();
    final Class<? super T> rawType = typeToken.getRawType();

    // first try an instance creator
    @SuppressWarnings("unchecked") // types must agree
    final InstanceCreator<T> typeCreator = (InstanceCreator<T>) instanceCreators.get(type);
    if (typeCreator != null) {
      return new ObjectConstructor<T>() {
        @Override public T construct() {
          return typeCreator.createInstance(type);
        }
      };
    }

    // Next try raw type match for instance creators
    @SuppressWarnings("unchecked") // types must agree
    final InstanceCreator<T> rawTypeCreator =
        (InstanceCreator<T>) instanceCreators.get(rawType);
    if (rawTypeCreator != null) {
      return new ObjectConstructor<T>() {
        @Override public T construct() {
          return rawTypeCreator.createInstance(type);
        }
      };
    }

    // 采用默认的构造方法进行初始化
    ObjectConstructor<T> defaultConstructor = newDefaultConstructor(rawType);
    if (defaultConstructor != null) {
      return defaultConstructor;
    }

    // 创建集合类相关对象
    ObjectConstructor<T> defaultImplementation = newDefaultImplementationConstructor(type, rawType);
    if (defaultImplementation != null) {
      return defaultImplementation;
    }

    // 最终使用Unsafe类进行创建对象 
    return newUnsafeAllocator(type, rawType);
  }

unSafe.class

UnSafe包是一个神奇的类，美团技术团队Unsafe应用解析讲的很好，有兴趣可以看看。
我这里就简单说下其中使用Unsafe包创建对象, 在说之前先看下通过反射进行初始化方式。

public class People {
    private String name;
    public String getName() {
        return name;
    }
    public void setName(String name) {
        this.name = name;
    }
}

反射方式：

Class<?> clazz1 = null;
try {
      clazz1 = Class.forName("com.company.unsafe.People");
    } catch (ClassNotFoundException e) {
         e.printStackTrace();
    }
People people = null;
if (clazz1 != null) {
  try {
         people = (People) clazz1.getDeclaredConstructor().newInstance();
      } catch (InstantiationException | IllegalAccessException | NoSuchMethodException | InvocationTargetException e) {
        e.printStackTrace();
      }
}
people.setName("EdisonLi");
System.out.println(people.getName());

如果将People类共有空参数构造方法改为私有空参数构造方法的话，反射创建该类就会报错。

java.lang.IllegalAccessException: class com.company.unsafe.UnsafeMain cannot access a member of class com.company.unsafe.People with modifiers "private"
    at java.base/jdk.internal.reflect.Reflection.newIllegalAccessException(Reflection.java:360)
    at java.base/java.lang.reflect.AccessibleObject.checkAccess(AccessibleObject.java:589)
    at java.base/java.lang.reflect.Constructor.newInstance(Constructor.java:479)
    at com.company.unsafe.UnsafeMain.main(UnsafeMain.java:18)
Exception in thread "main" java.lang.NullPointerException
    at com.company.unsafe.UnsafeMain.main(UnsafeMain.java:23)

这时我们的Unsafe类该闪亮登场喽！

Class<?> unsafeClazz = Class.forName("sun.misc.Unsafe");
Field f = unsafeClazz.getDeclaredField("theUnsafe");
f.setAccessible(true);
// theUnsafe 是final static 的 所以可以传null
Object unsafe = f.get(null);
final Method allocateInstance = unsafeClazz.getMethod("allocateInstance", Class.class);
People people  = (People) allocateInstance.invoke(unsafe, People.class);
people.setName("EdisonLi");
System.out.println(people.getName());

经测试，unsafe.class#allocateInstance()可以绕过构造进行初始化类，因此GSON也是利用这一点进行JsonBean的初始化。从而由于Kotlin Data Class 中空判断是在构造函数中进行创建的，所以导致空判断失效。