Sharding-jdbc框架漏洞-1.x

问题描述

收到error日志告警,出现多条下列错误日志

[2021-02-03 16:55:32.469][ERROR][http-nio-8249-exec-44][com.jiu.common.online.exception.GlobalExceptionHandler][127.0.0.1][[]请求异常:/merchant/cashierArea/listCashiierAreaorg.mybatis.spring.MyBatisSystemException: nested exception is org.apache.ibatis.exceptions.PersistenceException: ### Error querying database. 
Cause: java.lang.IndexOutOfBoundsException: Index: 1, Size: 0 ### The error may exist in class path resource [mapper/zx_business_machine/HsyCashierAreaMapper.xml] ### The error may involve defaultParameterMap ### The error occurred while setting parameters ### SQL: select F_id, F_cashier_area_no, F_cashier_area_name, F_merchant_id, F_create_time, F_update_time from t_hsy_cashier_area where f_merchant_id = ? order by f_create_time desc limit ?,? ### 
Cause: java.lang.IndexOutOfBoundsException: Index: 1, Size: 0 
    at org.mybatis.spring.MyBatisExceptionTranslator.translateExceptionIfPossible(MyBatisExceptionTranslator.java:77) 
    at org.mybatis.spring.SqlSessionTemplate$SqlSessionInterceptor.invoke(SqlSessionTemplate.java:446) 
    at com.sun.proxy.$Proxy142.selectList(Unknown Source) 
    at org.mybatis.spring.SqlSessionTemplate.selectList(SqlSessionTemplate.java:230) 
    at org.apache.ibatis.binding.MapperMethod.executeForMany(MapperMethod.java:144) 
    at org.apache.ibatis.binding.MapperMethod.execute(MapperMethod.java:77) 
    at org.apache.ibatis.binding.MapperProxy.invoke(MapperProxy.java:58) 
    at com.sun.proxy.$Proxy173.listCashierAreaByMerchantId(Unknown Source) 
    at com.jiu.online.machine.hsy.service.impl.CashierAreaServiceImpl.listCashierArea(CashierAreaServiceImpl.java:310) 
    at com.jiu.online.machine.hsy.service.impl.CashierAreaServiceImpl$$FastClassBySpringCGLIB$$4cc36c10.invoke() 
    at org.springframework.cglib.proxy.MethodProxy.invoke(MethodProxy.java:204) 
    at org.springframework.aop.framework.CglibAopProxy$DynamicAdvisedInterceptor.intercept(CglibAopProxy.java:684) 
    at com.jiu.online.machine.hsy.service.impl.CashierAreaServiceImpl$$EnhancerBySpringCGLIB$$f7bc53d8.listCashierArea() 
    at com.jiu.online.machine.hsy.controller.CashierAreaController.listCashierArea(CashierAreaController.java:114) 
    at sun.reflect.GeneratedMethodAccessor513.invoke(Unknown Source) 
    at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43) 
    at java.lang.reflect.Method.invoke(Method.java:498) 
    at org.springframework.web.method.support.InvocableHandlerMethod.doInvoke(InvocableHandlerMethod.java:209) 
    at org.springframework.web.method.support.InvocableHandlerMethod.invokeForRequest(InvocableHandlerMethod.java:136) 
    at org.springframework.web.servlet.mvc.method.annotation.ServletInvocableHandlerMethod.invokeAndHandle(ServletInvocableHandlerMethod.java:102) 
    at org.springframework.web.servlet.mvc.method.annotation.RequestMappingHandlerAdapter.invokeHandlerMethod(RequestMappingHandlerAdapter.java:877) 
    at org.springframework.web.servlet.mvc.method.annotation.RequestMappingHandlerAdapter.handleInternal(RequestMappingHandlerAdapter.java:783) 
    at org.springframework.web.servlet.mvc.method.AbstractHandlerMethodAdapter.handle(AbstractHandlerMethodAdapter.java:87) 
    at org.springframework.web.servlet.DispatcherServlet.doDispatch(DispatcherServlet.java:991) 
    at org.springframework.web.servlet.DispatcherServlet.doService(DispatcherServlet.java:925) 
    at org.springframework.web.servlet.FrameworkServlet.processRequest(FrameworkServlet.java:974) 
    at org.springframework.web.servlet.FrameworkServlet.doPost(FrameworkServlet.java:877) 
    at javax.servlet.http.HttpServlet.service(HttpServlet.java:661) 
    at org.springframework.web.servlet.FrameworkServlet.service(FrameworkServlet.java:851) 
    at javax.servlet.http.HttpServlet.service(HttpServlet.java:742) 
    at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:231) 
    at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:166) 
    at org.apache.tomcat.websocket.server.WsFilter.doFilter(WsFilter.java:52) 
    at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:193) 
    at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:166) 
    at org.springframework.boot.actuate.metrics.web.servlet.WebMvcMetricsFilter.filterAndRecordMetrics(WebMvcMetricsFilter.java:158) 
    at org.springframework.boot.actuate.metrics.web.servlet.WebMvcMetricsFilter.filterAndRecordMetrics(WebMvcMetricsFilter.java:126) 
    at org.springframework.boot.actuate.metrics.web.servlet.WebMvcMetricsFilter.doFilterInternal(WebMvcMetricsFilter.java:111) 
    at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:107) 
    at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:193) 
    at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:166) 
    at com.jiu.online.machine.hsy.filter.SessionFilter.doFilter(SessionFilter.java:49) 
    at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:193) 
    at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:166) 
    at org.springframework.boot.actuate.web.trace.servlet.HttpTraceFilter.doFilterInternal(HttpTraceFilter.java:90) 
    at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:107) 
    at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:193) 
    at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:166) 
    at org.springframework.web.filter.RequestContextFilter.doFilterInternal(RequestContextFilter.java:99) 
    at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:107) 
    at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:193) 
    at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:166) 
    at org.springframework.web.filter.HttpPutFormContentFilter.doFilterInternal(HttpPutFormContentFilter.java:109) 
    at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:107) 
    at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:193) 
    at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:166) 
    at org.springframework.web.filter.HiddenHttpMethodFilter.doFilterInternal(HiddenHttpMethodFilter.java:93) 
    at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:107) 
    at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:193) 
    at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:166) 
    at org.springframework.cloud.sleuth.instrument.web.ExceptionLoggingFilter.doFilter(ExceptionLoggingFilter.java:48) 
    at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:193) 
    at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:166) 
    at brave.servlet.TracingFilter.doFilter(TracingFilter.java:86) 
    at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:193) 
    at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:166) 
    at com.jiu.common.online.filter.MonitorFilter.doFilter(MonitorFilter.java:54) 
    at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:193) 
    at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:166) 
    at org.springframework.web.filter.CharacterEncodingFilter.doFilterInternal(CharacterEncodingFilter.java:200) 
    at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:107) 
    at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:193) 
    at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:166) 
    at org.apache.catalina.core.StandardWrapperValve.invoke(StandardWrapperValve.java:198) 
    at org.apache.catalina.core.StandardContextValve.invoke(StandardContextValve.java:96) 
    at org.apache.catalina.authenticator.AuthenticatorBase.invoke(AuthenticatorBase.java:496) 
    at org.apache.catalina.core.StandardHostValve.invoke(StandardHostValve.java:140) 
    at org.apache.catalina.valves.ErrorReportValve.invoke(ErrorReportValve.java:81) 
    at org.apache.catalina.core.StandardEngineValve.invoke(StandardEngineValve.java:87) 
    at org.apache.catalina.connector.CoyoteAdapter.service(CoyoteAdapter.java:342) 
    at org.apache.coyote.http11.Http11Processor.service(Http11Processor.java:803) 
    at org.apache.coyote.AbstractProcessorLight.process(AbstractProcessorLight.java:66) 
    at org.apache.coyote.AbstractProtocol$ConnectionHandler.process(AbstractProtocol.java:790) 
    at org.apache.tomcat.util.net.NioEndpoint$SocketProcessor.doRun(NioEndpoint.java:1468) 
    at org.apache.tomcat.util.net.SocketProcessorBase.run(SocketProcessorBase.java:49) 
    at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1149) 
    at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:624) 
    at org.apache.tomcat.util.threads.TaskThread$WrappingRunnable.run(TaskThread.java:61) 
    at java.lang.Thread.run(Thread.java:748) 
Caused by: org.apache.ibatis.exceptions.PersistenceException: ### Error querying database. 
Cause: java.lang.IndexOutOfBoundsException: Index: 1, Size: 0 ### The error may exist in class path resource [mapper/zx_business_machine/HsyCashierAreaMapper.xml] ### The error may involve defaultParameterMap ### The error occurred while setting parameters ### SQL: select F_id, F_cashier_area_no, F_cashier_area_name, F_merchant_id, F_create_time, F_update_time from t_hsy_cashier_area where f_merchant_id = ? order by f_create_time desc limit ?,? ### 
Cause: java.lang.IndexOutOfBoundsException: Index: 1, Size: 0 
    at org.apache.ibatis.exceptions.ExceptionFactory.wrapException(ExceptionFactory.java:30) 
    at org.apache.ibatis.session.defaults.DefaultSqlSession.selectList(DefaultSqlSession.java:150) 
    at org.apache.ibatis.session.defaults.DefaultSqlSession.selectList(DefaultSqlSession.java:141) 
    at sun.reflect.GeneratedMethodAccessor373.invoke(Unknown Source) 
    at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43) 
    at java.lang.reflect.Method.invoke(Method.java:498) 
    at org.mybatis.spring.SqlSessionTemplate$SqlSessionInterceptor.invoke(SqlSessionTemplate.java:433) ... 87 common frames omitted 
Caused by: java.lang.IndexOutOfBoundsException: Index: 1, Size: 0 
    at java.util.ArrayList.rangeCheck(ArrayList.java:653) 
    at java.util.ArrayList.get(ArrayList.java:429) 
    at com.dangdang.ddframe.rdb.sharding.jdbc.util.ParameterList.set(ParameterList.java:82) 
    at com.dangdang.ddframe.rdb.sharding.parser.result.merger.Limit.replaceParameters(Limit.java:71) 
    at com.dangdang.ddframe.rdb.sharding.router.SQLRouteEngine.routeSQL(SQLRouteEngine.java:105) 
    at com.dangdang.ddframe.rdb.sharding.router.PreparedSQLRouter.route(PreparedSQLRouter.java:56) 
    at com.dangdang.ddframe.rdb.sharding.jdbc.ShardingPreparedStatement.routeSQL(ShardingPreparedStatement.java:162) 
    at com.dangdang.ddframe.rdb.sharding.jdbc.ShardingPreparedStatement.execute(ShardingPreparedStatement.java:112) 
    at sun.reflect.GeneratedMethodAccessor242.invoke(Unknown Source) 
    at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43) 
    at java.lang.reflect.Method.invoke(Method.java:498) 
    at org.apache.ibatis.logging.jdbc.PreparedStatementLogger.invoke(PreparedStatementLogger.java:59) 
    at com.sun.proxy.$Proxy256.execute(Unknown Source) 
    at org.apache.ibatis.executor.statement.PreparedStatementHandler.query(PreparedStatementHandler.java:64) 
    at org.apache.ibatis.executor.statement.RoutingStatementHandler.query(RoutingStatementHandler.java:79) 
    at sun.reflect.GeneratedMethodAccessor241.invoke(Unknown Source) 
    at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43) 
    at java.lang.reflect.Method.invoke(Method.java:498) 
    at org.apache.ibatis.plugin.Invocation.proceed(Invocation.java:49) 
    at com.jiu.online.machine.hsy.filter.SqlExecuteTimeCountInterceptor.intercept(SqlExecuteTimeCountInterceptor.java:53) 
    at org.apache.ibatis.plugin.Plugin.invoke(Plugin.java:61) 
    at com.sun.proxy.$Proxy254.query(Unknown Source) 
    at org.apache.ibatis.executor.SimpleExecutor.doQuery(SimpleExecutor.java:63) 
    at org.apache.ibatis.executor.BaseExecutor.queryFromDatabase(BaseExecutor.java:324) 
    at org.apache.ibatis.executor.BaseExecutor.query(BaseExecutor.java:156) 
    at org.apache.ibatis.executor.BaseExecutor.query(BaseExecutor.java:136) 
    at sun.reflect.GeneratedMethodAccessor236.invoke(Unknown Source) 
    at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43) 
    at java.lang.reflect.Method.invoke(Method.java:498) 
    at org.apache.ibatis.plugin.Invocation.proceed(Invocation.java:49) 
    at com.jiu.common.core.persistence.interceptor.PaginationInterceptor.intercept(PaginationInterceptor.java:74) 
    at org.apache.ibatis.plugin.Plugin.invoke(Plugin.java:61) 
    at com.sun.proxy.$Proxy253.query(Unknown Source) 
    at org.apache.ibatis.session.defaults.DefaultSqlSession.selectList(DefaultSqlSession.java:148) ... 92 common frames omitted ]

原因分析

根据异常栈信息,初步定为是sharding框架代码抛的下标越界异常


image.png

Cause: java.lang.IndexOutOfBoundsException: Index: 1, Size: 0
说明此时jdbcMethodInvocations这个list为空,但参数index传了1
初步判断是由于并发导致的

经过一番折腾,最终确定是由于并发情况下,框架出现了线程安全问题.且复现出现概率也蛮高的
复现演示图如下:


sharding1bug.gif

原因分析:

  • testThread-0线程和testThread-1线程对应的jdbcMethodInvocations对象竟然是同一个(但未定位到该原因,初步判断是由于本地缓存的原因)

  • 在执行完语句后,有个clearRouteContext的方法会clear这个list


    image.png
  • 在并发情况下,由于ArrayList非线程安全,可能导致上述问题

解决方案

  • 目前由于历史原因,用了sharding-jdbc1.3.3这一早期的版本,框架出现了问题,优先考虑升级,考虑升级至4.0.0-RC3版本
  • 经过测试以及查阅资料,该版本未出现问题
  • 线上采取灰度升级版本.逐步将部门所有项目的sharding-jdbc框架进行了升级

另外,sharding-jdbc 1.x这一古老版本和4.x版本存在很多不同,包括包名,分片接口,命名空间方式对应的标签等,着实也折腾得够呛(估计和被apache收购有关).具体的一些不同也可以参考我的另一篇文档
https://www.jianshu.com/p/39830e1ccf9b

总结

对于技术选型以及版本的选择真的要重视,一定是经过相关调研才敲定.像项目中竟然采用这么古老的版本实在不应该

最后编辑于
©著作权归作者所有,转载或内容合作请联系作者
  • 序言:七十年代末,一起剥皮案震惊了整个滨河市,随后出现的几起案子,更是在滨河造成了极大的恐慌,老刑警刘岩,带你破解...
    沈念sama阅读 218,204评论 6 506
  • 序言:滨河连续发生了三起死亡事件,死亡现场离奇诡异,居然都是意外死亡,警方通过查阅死者的电脑和手机,发现死者居然都...
    沈念sama阅读 93,091评论 3 395
  • 文/潘晓璐 我一进店门,熙熙楼的掌柜王于贵愁眉苦脸地迎上来,“玉大人,你说我怎么就摊上这事。” “怎么了?”我有些...
    开封第一讲书人阅读 164,548评论 0 354
  • 文/不坏的土叔 我叫张陵,是天一观的道长。 经常有香客问我,道长,这世上最难降的妖魔是什么? 我笑而不...
    开封第一讲书人阅读 58,657评论 1 293
  • 正文 为了忘掉前任,我火速办了婚礼,结果婚礼上,老公的妹妹穿的比我还像新娘。我一直安慰自己,他们只是感情好,可当我...
    茶点故事阅读 67,689评论 6 392
  • 文/花漫 我一把揭开白布。 她就那样静静地躺着,像睡着了一般。 火红的嫁衣衬着肌肤如雪。 梳的纹丝不乱的头发上,一...
    开封第一讲书人阅读 51,554评论 1 305
  • 那天,我揣着相机与录音,去河边找鬼。 笑死,一个胖子当着我的面吹牛,可吹牛的内容都是我干的。 我是一名探鬼主播,决...
    沈念sama阅读 40,302评论 3 418
  • 文/苍兰香墨 我猛地睁开眼,长吁一口气:“原来是场噩梦啊……” “哼!你这毒妇竟也来了?” 一声冷哼从身侧响起,我...
    开封第一讲书人阅读 39,216评论 0 276
  • 序言:老挝万荣一对情侣失踪,失踪者是张志新(化名)和其女友刘颖,没想到半个月后,有当地人在树林里发现了一具尸体,经...
    沈念sama阅读 45,661评论 1 314
  • 正文 独居荒郊野岭守林人离奇死亡,尸身上长有42处带血的脓包…… 初始之章·张勋 以下内容为张勋视角 年9月15日...
    茶点故事阅读 37,851评论 3 336
  • 正文 我和宋清朗相恋三年,在试婚纱的时候发现自己被绿了。 大学时的朋友给我发了我未婚夫和他白月光在一起吃饭的照片。...
    茶点故事阅读 39,977评论 1 348
  • 序言:一个原本活蹦乱跳的男人离奇死亡,死状恐怖,灵堂内的尸体忽然破棺而出,到底是诈尸还是另有隐情,我是刑警宁泽,带...
    沈念sama阅读 35,697评论 5 347
  • 正文 年R本政府宣布,位于F岛的核电站,受9级特大地震影响,放射性物质发生泄漏。R本人自食恶果不足惜,却给世界环境...
    茶点故事阅读 41,306评论 3 330
  • 文/蒙蒙 一、第九天 我趴在偏房一处隐蔽的房顶上张望。 院中可真热闹,春花似锦、人声如沸。这庄子的主人今日做“春日...
    开封第一讲书人阅读 31,898评论 0 22
  • 文/苍兰香墨 我抬头看了看天上的太阳。三九已至,却和暖如春,着一层夹袄步出监牢的瞬间,已是汗流浃背。 一阵脚步声响...
    开封第一讲书人阅读 33,019评论 1 270
  • 我被黑心中介骗来泰国打工, 没想到刚下飞机就差点儿被人妖公主榨干…… 1. 我叫王不留,地道东北人。 一个月前我还...
    沈念sama阅读 48,138评论 3 370
  • 正文 我出身青楼,却偏偏与公主长得像,于是被迫代替她去往敌国和亲。 传闻我的和亲对象是个残疾皇子,可洞房花烛夜当晚...
    茶点故事阅读 44,927评论 2 355

推荐阅读更多精彩内容