Fastjson @JSONType remote-JAR/FD-chain lab and detection

This repository now preserves two distinct Fastjson research tracks:

• modern-fd/ is the recommended, marker-only reconstruction of the Fastjson 1.2.83 single-body remote-JAR/file-descriptor chain on Spring Boot 3, normal embedded Tomcat and JDK 17. It uses the literal fixed-DTO sink JSON.parseObject(body, BoundEnvelope.class) with AutoType disabled.
• The original top-level Docker Compose lab preserves the earlier JDK 8 direct remote-class route. It is command-capable and should be treated as a legacy, isolated proof rather than the modern-JDK method.
• scanner/ contains passive request/log detection, static artifact inventory and a non-executing reachability probe.

The bug: ParserConfig.checkAutoType probes every @type value for the @JSONType annotation by doing getResourceAsStream(typeName.replace('.','/') + ".class"). On modern Linux/JDK combinations, a remote jar:http probe can leave the JAR cached behind an open descriptor; later jar:file:/proc/self/fd/N probes in the same body can reopen it under valid class names and initialize an annotated class. The exact 1.2.83 composition works with AutoType disabled and through a fixed DTO containing List. Binding alone is therefore not a mitigation. Full walk-through: docs/MECHANISM.md.

Security review findings

The companion whole-project review covered 2,041 callable/static-initializer rows across all 193 Fastjson 1.2.83 production Java files. The table below prioritizes the highest-impact results; it is not a claim that every Fastjson deployment is affected. This repository directly reproduces F105. The remaining entries summarize separately sealed source review and bounded lab evidence.