启用dubbo-validation后hessian反序列化异常解决方案

现象

启用 dubbo 参数验证，当在 provider 端开启验证validation=”true”。调用接口时，若接口参数为对象类型，对象属性验证失败，客户端会报如下异常。

2019-04-25T09:57:18.544+0800 [ERROR] business-service o.a.c.c.C.[.[.[.[dispatcherServlet] - - Servlet.service() for servlet [dispatcherServlet] in context with path [] threw exception [Request processing failed; nested exception is java.lang.reflect.UndeclaredThrowableException] with root cause
com.alibaba.dubbo.remoting.RemotingException: com.alibaba.com.caucho.hessian.io.HessianFieldException: org.hibernate.validator.internal.engine.ConstraintViolationImpl.constraintDescriptor: 'org.hibernate.validator.internal.metadata.descriptor.ConstraintDescriptorImpl' could not be instantiated
com.alibaba.com.caucho.hessian.io.HessianFieldException: org.hibernate.validator.internal.engine.ConstraintViolationImpl.constraintDescriptor: 'org.hibernate.validator.internal.metadata.descriptor.ConstraintDescriptorImpl' could not be instantiated
    at com.alibaba.com.caucho.hessian.io.JavaDeserializer.logDeserializeError(JavaDeserializer.java:167)
    at com.alibaba.com.caucho.hessian.io.JavaDeserializer$ObjectFieldDeserializer.deserialize(JavaDeserializer.java:410)
    at com.alibaba.com.caucho.hessian.io.JavaDeserializer.readObject(JavaDeserializer.java:276)
    at com.alibaba.com.caucho.hessian.io.JavaDeserializer.readObject(JavaDeserializer.java:203)
    at com.alibaba.com.caucho.hessian.io.SerializerFactory.readObject(SerializerFactory.java:526)
... more
Caused by: com.alibaba.com.caucho.hessian.io.HessianProtocolException: 'org.hibernate.validator.internal.metadata.descriptor.ConstraintDescriptorImpl' could not be instantiated
    at com.alibaba.com.caucho.hessian.io.JavaDeserializer.instantiate(JavaDeserializer.java:316)
    at com.alibaba.com.caucho.hessian.io.JavaDeserializer.readObject(JavaDeserializer.java:201)
    at com.alibaba.com.caucho.hessian.io.Hessian2Input.readObjectInstance(Hessian2Input.java:2818)
    at com.alibaba.com.caucho.hessian.io.Hessian2Input.readObject(Hessian2Input.java:2145)
    at com.alibaba.com.caucho.hessian.io.Hessian2Input.readObject(Hessian2Input.java:2074)
    at com.alibaba.com.caucho.hessian.io.Hessian2Input.readObject(Hessian2Input.java:2118)
    at com.alibaba.com.caucho.hessian.io.Hessian2Input.readObject(Hessian2Input.java:2074)
    at com.alibaba.com.caucho.hessian.io.JavaDeserializer$ObjectFieldDeserializer.deserialize(JavaDeserializer.java:406)
    ... 41 more
Caused by: java.lang.reflect.InvocationTargetException
    at sun.reflect.NativeConstructorAccessorImpl.newInstance0(Native Method)
    at sun.reflect.NativeConstructorAccessorImpl.newInstance(NativeConstructorAccessorImpl.java:62)
    at sun.reflect.DelegatingConstructorAccessorImpl.newInstance(DelegatingConstructorAccessorImpl.java:45)
    at java.lang.reflect.Constructor.newInstance(Constructor.java:423)
    at com.alibaba.com.caucho.hessian.io.JavaDeserializer.instantiate(JavaDeserializer.java:312)
    ... 48 more
Caused by: java.lang.NullPointerException
    at org.hibernate.validator.internal.metadata.descriptor.ConstraintDescriptorImpl.<init>(ConstraintDescriptorImpl.java:176)
    at org.hibernate.validator.internal.metadata.descriptor.ConstraintDescriptorImpl.<init>(ConstraintDescriptorImpl.java:233)
    ... more

版本

<dependency>
    <groupId>org.apache.dubbo</groupId>
    <artifactId>dubbo</artifactId>
    <version>2.7.1</version>
</dependency>

同时测试了 2.6.5 也有同样的问题。

分析

异常表象为 ’org.hibernate.validator.internal.metadata.descriptor.ConstraintDescriptorImpl’ could not be instantiated，在继续跟踪栈信息是在下面的地方抛出了 NullPointerException 异常。

Caused by: java.lang.NullPointerException
    at org.hibernate.validator.internal.metadata.descriptor.ConstraintDescriptorImpl.<init>(ConstraintDescriptorImpl.java:176)
    at org.hibernate.validator.internal.metadata.descriptor.ConstraintDescriptorImpl.<init>(ConstraintDescriptorImpl.java:233)

进入 ConstraintDescriptorImpl.java:176 行看下，代码如下：

public ConstraintDescriptorImpl(ConstraintHelper constraintHelper,
            Member member,
            ConstraintAnnotationDescriptor<T> annotationDescriptor,
            ElementType type,
            Class<?> implicitGroup,
            ConstraintOrigin definedOn,
            ConstraintType externalConstraintType) {
this.annotationDescriptor = annotationDescriptor;
this.elementType = type;
this.definedOn = definedOn;
this.isReportAsSingleInvalidConstraint = annotationDescriptor.getType().isAnnotationPresent(ReportAsSingleViolation.class);

... more

报空指针的位置就是

this.isReportAsSingleInvalidConstraint = annotationDescriptor.getType().isAnnotationPresent(ReportAsSingleViolation.class);

结论

dubbo 使用默认序列化协议 hessian，在反序列化时根据 构造函数参数个数优先级来取参数最少的构造器 ，由于 ConstraintDescriptorImpl 该类只一个构造器，debug 进入发现在初始化时传入的参数全部为 null，这就造成了 NullPointerException 异常，导致序列化失败。
从 ConstraintViolationException 继承结构可以看到其继承自 ValidationException，并增加了一个参数 private final Set<ConstraintViolation<?>> constraintViolations; 用来将验证信息传递到 consumer，反序列化的问题就是出在了 Set<ConstraintViolation<?>> 上。

解决方案

知道了问题出在哪里，那解决起来还是很方便的。既然 Set<ConstraintViolation<?>> constraintViolations 是为了将校验信息传递到 consumer，那我们自己自定义一个校验信息体就 OK 啦。
使用 dubbo 验证扩展自定义一个 validation。

具体实现如下：
实现一个 Validation 接口，返回一个自定义的 Validator

package com.example.demo.dubbo.validation;

import org.apache.dubbo.common.URL;
import org.apache.dubbo.validation.Validation;
import org.apache.dubbo.validation.Validator;

/**
 * @ClassName CustomValidation
 * @Description
 * @Author lixin
 * @Date 2019-04-23 17:34
 */
public class CustomValidation implements Validation{

    @Override
    public Validator getValidator(URL url) {return new CustomValidator(url);
    }
}

CustomValidation 实现，这里只需要简单的捕获一下 ConstraintViolationException 异常，将 violations 取出重新格式化即可，同时还保持了 dubbo validation 的原生逻辑支持

package com.example.demo.dubbo.validation;

import org.apache.dubbo.common.URL;
import org.apache.dubbo.common.json.JSONArray;
import org.apache.dubbo.common.json.JSONObject;
import org.apache.dubbo.common.utils.ReflectUtils;
import org.apache.dubbo.validation.support.jvalidation.JValidator;
import org.apache.dubbo.validation.Validator;

import javax.validation.*;
import java.util.*;

/**
 * 继承自 {@link JValidator} 保证了 dubbo 原生的 vidation 逻辑。* 修改点：1、捕获 ConstraintViolationException 异常，将验证未通过异常改为 ValidationException，解决 dubbo hessian 反序列化失败问题
 *       2、格式化验证提示，使用 json 格式响应
 *
 * @Author lixin
 * @Date 2019-04-23 17:35
 */
public class CustomValidator extends JValidator implements Validator {

    private final Class<?> clazz;

    @SuppressWarnings({"unchecked", "rawtypes"})
    public CustomValidator(URL url) {super(url);
        this.clazz = ReflectUtils.forName(url.getServiceInterface());
    }

    @Override
    public void validate(String methodName, Class<?>[] parameterTypes, Object[] arguments) throws Exception {

        try{super.validate(methodName,parameterTypes,arguments);
        }catch (ConstraintViolationException e){throw new ValidationException(constraintMessage(clazz.getName(),methodName,e.getConstraintViolations()));
        }
    }

    private String constraintMessage(String className,String methodName,Set<ConstraintViolation<?>> violations){JSONObject json = new JSONObject();
        json.put("service",className);
        json.put("method",methodName);

        JSONArray details = new JSONArray();
        for(ConstraintViolation violation : violations){JSONObject detail = new JSONObject();
            detail.put("bean",violation.getRootBean().getClass().getName());
            detail.put("property",violation.getPropertyPath().toString());
            detail.put("message",violation.getMessage());
            details.add(detail);
        }
        json.put("details",details);
        return json.toString();}
}

使用方式

provider 端启用(注解方式)

@Service(validation = "xxx")

consumer 端启用(注解方式)

@Reference(validation = "xxx")

建议

1、在 consumer 端开启验证，以减少无用的请求打到 provider 端。
2、自定义的 model 类，增加默认构造器。