FasterXML / FasterXML/jackson-databind

Jackson 3: `@JsonSubTypes` does not affect validity checks for `Id.CLASS`, only `Id.NAME`

Open
#5,320 8 comments 1 reaction 0 assignees View on GitHub
3.x polymorphic-handling
Dominant language
Java
Stars
3.7k
Forks
1.5k
Avg merge
3d 5h
Merged PRs (30d)
30

Description

### Search before asking

- [x] I searched in the [issues](https://github.com/FasterXML/jackson-databind/issues) and found nothing similar.

### Describe the bug

Please find below a reproducer for a use case we have for Spring Security Jackson 3 support, where we would like to disable global default typing (for better security) and just rely on `@JsonTypeInfo` + `@JsonSubTypes` for polymorphic deserialization, and that seems not possible.

Despite the fact we register a strict set of sub types via `@JsonSubTypes` to deserialize `Object principal`, Jackson 3 requires a custom `PolymorphicTypeValidator`, which we would like to avoid because we try to remove mandatory mapper configuration.

Could `DefaultBaseTypeLimitingValidator` relax its checks in that case and take in account `@JsonSubTypes` configured in the mixins?

### Version Information

3.0.0-rc10

### Reproduction

```java
import com.fasterxml.jackson.annotation.JsonSubTypes;
import com.fasterxml.jackson.annotation.JsonTypeInfo;
import org.junit.jupiter.api.Test;
import tools.jackson.databind.json.JsonMapper;

import static org.assertj.core.api.Assertions.assertThat;

public class JacksonPTVTests {

@Test
void stringPrincipal() {
JsonMapper mapper = new JsonMapper();
String json = mapper.writeValueAsString(new User("bob"));
User user = mapper.readValue(json, User.class);
assertThat(user.principal()).isEqualTo("bob");
}

@Test
void customPrincipal() {
JsonMapper mapper = new JsonMapper();
String json = mapper.writeValueAsString(new User(new CustomPrincipal("bob")));
User user = mapper.readValue(json, User.class);
assertThat(user.principal()).isInstanceOf(CustomPrincipal.class);
}

@JsonTypeInfo(use = JsonTypeInfo.Id.CLASS, include = JsonTypeInfo.As.PROPERTY)
record User(
@JsonTypeInfo(use = JsonTypeInfo.Id.CLASS, include = JsonTypeInfo.As.PROPERTY)
@JsonSubTypes({ @JsonSubTypes.Type(CustomPrincipal.class)})
Object principal) {
}

record CustomPrincipal(String login) {
}
}
```

Generates the following error
```
Configured `PolymorphicTypeValidator` (of type `tools.jackson.databind.jsontype.DefaultBaseTypeLimitingValidator`) denies resolution of all subtypes of base type `java.lang.Object` as using too generic base type can open a security hole without checks on subtype: please configure a custom `PolymorphicTypeValidator` for this use case
```

### Expected behavior

`@JsonSubTypes({ @JsonSubTypes.Type(CustomPrincipal.class)})` is enough to make the `Object principal` deserialization safe and authorized by default.

### Additional context

_No response_

Contributor guide

No contributing guide indexed for this repository

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.