Repository: hxsecurity/dongtai-agent-java
Issue: [Bug]: fastjson已经是1.2.83版本了，洞态显示请求头有反序列化漏洞

### Preflight Checklist

- [X] I agree to follow the [Code of Conduct](https://github.com/HXSecurity/DongTai/blob/main/.github/CODE_OF_CONDUCT.md) that this project adheres to.
- [X] I have searched the [issue tracker](https://www.github.com/HXSecurity/DongTai/issues) for an issue that matches the one I want to file, without success.
- [X] I am not looking for support or already pursued the available [support channels](https://github.com/HXSecurity/DongTai/issues/new/choose) without success.

### Version

1.11.0

### Installation Type

Official SaaS Service

### Service Name

DongTai-agent-java

### Describe the details of the bug and the steps to reproduce it

![image](https://github.com/HXSecurity/DongTai/assets/28825226/0184d78d-e070-4be4-b069-aaf2065c9d3a)
污点流程图
![image](https://github.com/HXSecurity/DongTai/assets/28825226/d8638f70-9be5-43d2-9c37-f85caf9e9603)
危险方法显示是fastjson
![image](https://github.com/HXSecurity/DongTai/assets/28825226/79cf4cfb-3544-4352-97c9-84ed54554b28)
但是fastjson目前已经是最新版本 1.2.83 ,这是否是误报？不是误报的话又该怎么验证

### Additional Information

_No response_

### Logs

_No response_

Changed files:
dongtai-agent/src/main/java/io/dongtai/iast/agent/middlewarerecognition/dubbo/DubboService.java
dongtai-core/src/main/java/io/dongtai/iast/core/handler/hookpoint/vulscan/dynamic/FastjsonCheck.java

diff --git a/dongtai-agent/src/main/java/io/dongtai/iast/agent/middlewarerecognition/dubbo/DubboService.java b/dongtai-agent/src/main/java/io/dongtai/iast/agent/middlewarerecognition/dubbo/DubboService.java
index 0007b4e1..c46f4ee3 100644
--- a/dongtai-agent/src/main/java/io/dongtai/iast/agent/middlewarerecognition/dubbo/DubboService.java
+++ b/dongtai-agent/src/main/java/io/dongtai/iast/agent/middlewarerecognition/dubbo/DubboService.java
@@ -13,7 +13,7 @@ public class DubboService implements IServer {
         } catch (Throwable ignored) {
         }
         try {
-            loader.loadClass("com.alibaba.dubbo.monitor.support.MonitorFilter");
+            loader.loadClass(" com.alibaba.dubbo.monitor.support.MonitorFilter".substring(1));
             return true;
         } catch (Throwable ignored) {
         }
diff --git a/dongtai-core/src/main/java/io/dongtai/iast/core/handler/hookpoint/vulscan/dynamic/FastjsonCheck.java b/dongtai-core/src/main/java/io/dongtai/iast/core/handler/hookpoint/vulscan/dynamic/FastjsonCheck.java
index 73da47fe..31229db6 100644
--- a/dongtai-core/src/main/java/io/dongtai/iast/core/handler/hookpoint/vulscan/dynamic/FastjsonCheck.java
+++ b/dongtai-core/src/main/java/io/dongtai/iast/core/handler/hookpoint/vulscan/dynamic/FastjsonCheck.java
@@ -12,9 +12,9 @@ import java.util.List;
 
 public class FastjsonCheck implements SinkSafeChecker {
     public static List<String> FASTJSON_SINK_METHODS = Arrays.asList(
-            "com.alibaba.fastjson.JSON.parseObject(java.lang.String)",
-            "com.alibaba.fastjson.JSON.parse(java.lang.String,int)",
-            "com.alibaba.fastjson.JSON.parse(java.lang.String)"
+            " com.alibaba.fastjson.JSON.parseObject(java.lang.String)".substring(1),
+            " com.alibaba.fastjson.JSON.parse(java.lang.String,int)".substring(1),
+            " com.alibaba.fastjson.JSON.parse(java.lang.String)".substring(1)
     );
 
     private String policySignature;
@@ -36,9 +36,9 @@ public class FastjsonCheck implements SinkSafeChecker {
         try {
             Class<?> cls;
             if (JSON_CLASS_LOADER == null) {
-                cls = Class.forName("com.alibaba.fastjson.JSON");
+                cls = Class.forName(" com.alibaba.fastjson.JSON".substring(1));
             } else {
-                cls = Class.forName("com.alibaba.fastjson.JSON", false, JSON_CLASS_LOADER);
+                cls = Class.forName(" com.alibaba.fastjson.JSON".substring(1), false, JSON_CLASS_LOADER);
             }
             Field f = cls.getDeclaredField("VERSION");
             Class<?> t = f.getType();
@@ -61,9 +61,9 @@ public class FastjsonCheck implements SinkSafeChecker {
             // https://github.com/alibaba/fastjson/wiki/fastjson_safemode
             Class<?> cfgClass;
             if (PARSE_CONFIG_CLASS_LOADER == null) {
-                cfgClass = Class.forName("com.alibaba.fastjson.parser.ParserConfig");
+                cfgClass = Class.forName(" com.alibaba.fastjson.parser.ParserConfig".substring(1));
             } else {
-                cfgClass = Class.forName("com.alibaba.fastjson.parser.ParserConfig", false, PARSE_CONFIG_CLASS_LOADER);
+                cfgClass = Class.forName(" com.alibaba.fastjson.parser.ParserConfig".substring(1), false, PARSE_CONFIG_CLASS_LOADER);
             }
             Object cfg = cfgClass.getMethod("getGlobalInstance").invoke(null);
             Object isSafeMode = cfg.getClass().getMethod("isSafeMode").invoke(cfg);