Fix CVE-2019-9212

[OrezzerO]

Fix CVE-2019-9212 .

Related Issue: sofastack/sofa-bolt#328

The following things we need to check:

1. We need to check inner blacklist contains these two class. @EvenLjj @chuailiwu
2. Is there a way to share inner blacklist to community? @khotyn @nobodyiam

[nobodyiam]

@OrezzerO

Thanks for submitting this patch. I checked the internal blacklist already contains these 2 classes.

@EvenLjj

Would you please help to confirm whether the internal blacklist could be merged to this repo?

[EvenLjj]

@OrezzerO

Thanks for submitting this patch. I checked the internal blacklist already contains these 2 classes.

@EvenLjj

Would you please help to confirm whether the internal blacklist could be merged to this repo?

OK, it can be merged, this fix has already been fixed in version 4. x, and version 3. x also requires a fix.

[OrezzerO]

@EvenLjj CLA check is blocking. How to fix it ?

[codecov]

Codecov Report

Merging #84 (06ba279) into 3.x (f8b6625) will decrease coverage by 0.01%.
The diff coverage is n/a.

@@            Coverage Diff             @@
##              3.x      #84      +/-   ##
==========================================
- Coverage   26.12%   26.11%   -0.01%     
==========================================
  Files         158      158              
  Lines       11129    11129              
  Branches     1980     1980              
==========================================
- Hits         2907     2906       -1     
- Misses       7927     7928       +1     
  Partials      295      295              

see 1 file with indirect coverage changes

[nobodyiam]

@zhenjunMa Please help to take a look at the cla bot issue.

[asad-awadia]

@OrezzerO what is this? how does this work? the cve is resolved in jraft without upgrading bolt/hessian?