Spring AOP 新链实现任意无参方法调用技术分析<\/h1>

1. AOP核心概念<\/h2>

1.1 基本术语<\/h3>

切面(Aspect)<\/strong>: 公共功能的实现模块，如日志、权限、验签等。使用@Aspect<\/code>注解修饰的Java类<\/li>
通知(Advice)<\/strong>: 切面的具体实现方法，分为: 前置通知(Before)<\/li> 后置通知(AfterReturning)<\/li> 异常通知(AfterThrowing)<\/li> 最终通知(After)<\/li> 环绕通知(Around)<\/li> <\/ul> <\/li> 连接点(JoinPoint)<\/strong>: 程序运行中可插入切面的位置，Spring仅支持方法级连接点<\/li> 切点(PointCut)<\/strong>: 定义通知应应用到哪些连接点的规则<\/li> 引入(Introduction)<\/strong>: 动态为类添加新接口实现<\/li> <\/ul> 1.2 依赖关系<\/h3> spring-boot-starter-aop<\/code>包含:<\/p> spring-aop<\/code><\/li> aspectjweaver<\/code><\/li> <\/ul> 2. AOP实现机制<\/h2> 2.1 动态代理与拦截<\/h3> JdkDynamicAopProxy<\/code>类:<\/p> JDK动态代理的调用处理器<\/li> 代理对象方法调用时跳转到invoke<\/code>方法处理<\/li> 调用目标方法前检查是否配置拦截链<\/li> <\/ul> 两种处理路径:<\/p> 拦截链为空(chain.isEmpty()<\/code>): 直接反射调用目标方法<\/li> 配置拦截链: 通过拦截链层层处理后再调用目标方法<\/li> <\/ol> 2.2 拦截链构建<\/h3> AdvisedSupport<\/code>类处理代理配置:<\/p> readObject<\/code>初始化空的methodCache<\/code> Map<\/li> 首次获取拦截链返回null<\/li> 通过getInterceptorsAndDynamicInterceptionAdvice<\/code>构建拦截链<\/li> <\/ul> 拦截链构建过程:<\/p> 从配置获取Advisor<\/code>(包含advice和匹配过滤器)<\/li> 判断advice类型(PointCut或Introduction)<\/li> 通过DefaultAdvisorAdapterRegistry.getInterceptors<\/code>获取Interceptor<\/li> 合并到interceptorList<\/code><\/li> <\/ol> MethodInterceptor<\/code>接口:<\/p> 用于拦截目标方法调用<\/li> 通过invoke<\/code>方法添加拦截逻辑<\/li> <\/ul> 2.3 拦截链执行<\/h3> ReflectiveMethodInvocation<\/code>类:<\/p> currentInterceptorIndex<\/code>跟踪当前拦截器位置<\/li> 执行完所有拦截器后调用目标方法(invokeJoinpoint<\/code>)<\/li> 动态匹配方法时先检查方法是否匹配<\/li> <\/ul> 3. 切面方法调用机制<\/h2> 3.1 Advice调用流程<\/h3> AbstractAspectJAdvice<\/code>抽象类:<\/p> 包含各种通知类型的子类(Before, After等)<\/li> invokeAdviceMethod<\/code>最终调用切面方法<\/li> aspectJAdviceMethod<\/code>: advice对应的方法(如logBefore<\/code>)<\/li> <\/ul> 方法恢复:<\/p> Method<\/code>未实现Serializable<\/code><\/li> aspectJAdviceMethod<\/code>由transient<\/code>修饰<\/li> readObject<\/code>时通过反射恢复<\/li> <\/ul> 3.2 实例工厂<\/h3> AspectInstanceFactory<\/code>实现类:<\/p> SimpleAspectInstanceFactory<\/code>: 反射调用无参构造器(不可序列化)<\/li> SingletonAspectInstanceFactory<\/code>: 单例工厂(可序列化)<\/li> SimpleBeanFactoryAwareAspectInstanceFactory<\/code>: 由Bean工厂创建<\/li> SimpleJndiBeanFactory<\/code>: JNDI工厂(不可序列化)<\/li> <\/ol> 3.3 参数绑定<\/h3> AbstractAspectJAdvice#argBinding<\/code>:<\/p> jpMatch<\/code>来自getJoinPointMatch<\/code><\/li> 需要ProxyMethodInvocation#setUserAttribute<\/code>设置属性<\/li> 当前仅支持无参方法调用<\/li> <\/ul> 4. 任意无参方法调用实现<\/h2> 4.1 关键问题<\/h3> 直接构造会报错缺少MethodInvocation<\/code>:<\/p> ExposeInvocationInterceptor<\/code>拦截器负责设置MethodInvocation<\/code><\/li> 需要先注册此interceptor再注册advice<\/li> <\/ul> 4.2 实现步骤<\/h3> 创建SingletonAspectInstanceFactory<\/code>实例<\/li> 设置目标方法(如TemplatesImpl#newTransformer<\/code>)<\/li> 构建拦截链: 先添加ExposeInvocationInterceptor<\/code><\/li> 再添加自定义advice<\/li> <\/ul> <\/li> 通过JdkDynamicAopProxy<\/code>执行调用链<\/li> <\/ol> 4.3 示例代码结构<\/h3> \/\/ 1. 创建单例工厂 <\/span><\/span><\/span><\/span>SingletonAspectInstanceFactory factory =<\/span> new<\/span> SingletonAspectInstanceFactory(<\/span>targetObject);<\/span> <\/span><\/span> <\/span><\/span>\/\/ 2. 设置目标方法 <\/span><\/span><\/span><\/span>Method method =<\/span> TemplatesImpl.<\/span>class<\/span>.<\/span>getMethod<\/span>(<\/span>"newTransformer"<\/span>);<\/span> <\/span><\/span> <\/span><\/span>\/\/ 3. 构建拦截链 <\/span><\/span><\/span><\/span>List<<\/span>Object><\/span> interceptors =<\/span> new<\/span> ArrayList<>();<\/span> <\/span><\/span>interceptors.<\/span>add<\/span>(<\/span>new<\/span> ExposeInvocationInterceptor());<\/span> <\/span><\/span>interceptors.<\/span>add<\/span>(<\/span>new<\/span> MyAdvice(<\/span>factory,<\/span> method));<\/span> <\/span><\/span> <\/span><\/span>\/\/ 4. 创建代理调用 <\/span><\/span><\/span><\/span>JdkDynamicAopProxy proxy =<\/span> new<\/span> JdkDynamicAopProxy(<\/span>config);<\/span> <\/span><\/span>proxy.<\/span>invoke<\/span>(<\/span>proxy,<\/span> method,<\/span> new<\/span> Object[]{});<\/span> <\/span><\/span><\/code><\/pre>5. 限制与注意事项<\/h2> 仅支持无参方法调用<\/li> 依赖SingletonAspectInstanceFactory<\/code>可序列化<\/li> 拦截链顺序必须正确(ExposeInvocationInterceptor优先)<\/li> 目标类必须可访问<\/li> 安全限制可能阻止某些方法调用<\/li> <\/ol> 6. 防御建议<\/h2> 限制反序列化源<\/li> 监控可疑的AOP配置<\/li> 更新Spring框架版本<\/li> 实施最小权限原则<\/li> 对输入进行严格验证<\/li> <\/ol>

Spring AOP 新链实现任意无参方法调用技术分析<\/h1>

1. AOP核心概念<\/h2>

2. AOP实现机制<\/h2>

3. 切面方法调用机制<\/h2>

4. 任意无参方法调用实现<\/h2>

6. 防御建议<\/h2> 限制反序列化源<\/li> 监控可疑的AOP配置<\/li> 更新Spring框架版本<\/li> 实施最小权限原则<\/li> 对输入进行严格验证<\/li> <\/ol>

6. 防御建议<\/h2>

限制反序列化源<\/li>
监控可疑的AOP配置<\/li>
更新Spring框架版本<\/li>
实施最小权限原则<\/li>
对输入进行严格验证<\/li> <\/ol>