Merge pull request #1087 from weibocom/fix_security_issue

add serialize blacklist

Author: rayzhang0603

motan-core/src/main/java/com/weibo/api/motan/serialize/Hessian2Serialization.java

@@ -175,6 +175,10 @@ private static SerializerFactory initDefaultSerializerFactory() {
                 classFactory.deny("sun.print.*");
                 classFactory.deny("sun.rmi.*");
                 classFactory.deny("sun.swing.*");
+                classFactory.deny("com.alibaba.citrus.springext.*");
+                classFactory.deny("com.alipay.custrelation.*");
+                classFactory.deny("com.alibaba.druid.*");
+                classFactory.deny("org.apache.catalina.tribes.*");
             } catch (Exception e) {
                 LoggerUtil.warn("Hessian2Serialization init deny list failed, please upgrade hessian to version 4.0.66 or later", e);
             }