FasterXML / FasterXML/jackson-future-ideas

Variant databind artifact that doesn't support default typing

Offen
#41 9 Kommentare 0 Reaktionen 0 zugewiesene Personen Auf GitHub ansehen
Vorherrschende Sprache
Keine Sprachdaten
Sterne
21
Forks
3
PR-Merge-Kennzahlen
Keine gemergten PRs in 30 T.

Beschreibung

I would like a variant of databind that doesn't support the "dynamic typing" anti-feature.

Every so often a new class gets added to the "default typing" blacklist. Whenever this happens, security scanners report all projects using databind as having a critical vulnerability and requiring "remediation" in a short timeframe.

While it is extremely unlikely that any of the projects are actually using default typing, the scanners can't figure this out. (If any projects actually did enable it, that would be a significant security concern in itself.)

A separate databind variant that doesn't support default typing would permit scanners to determine these blacklist additions are not relevant and thus avoid this periodic waste of effort.

Alternatively, the blacklist could be moved to a new, separate artifact. Databind would then refuse to enable default typing unless it could load that artifact.

Beitragsleitfaden

Für dieses Repository ist kein Beitragsleitfaden indexiert

Bewertung

Dieses Issue wurde noch nicht bewertet.

Neue Issues direkt in Ihr Postfach

Eine kurze Übersicht über anfängerfreundliche GitHub-Issues.