Add Jackson PolymorphicTypeValidator
- Dominant language
- Java
- Stars
- 3.2k
- Forks
- 1.2k
- PR merge metrics
- No merged PRs in 30d
Description
This Jackson usage is very dangerous. It means that Jackson will load any class that appears in the JSON. There is a disallow list for well-known gadgets but it is highly recommended to a PolymorphicTypeValidator to your ObjectMapper to lock down which classes can be loaded.
https://github.com/search?q=repo%3Aapache%2Fcurator%20Id.CLASS&type=code
Example
https://github.com/apache/drill/pull/3057/changes#diff-e55fd14c5d3a9a463736a342682c0f7d3644d1e47ba6700c1fce001a493deda1R69
Contributor guide
No contributing guide indexed for this repository
Research direction
Search the repository for Id.CLASS and Jackson ObjectMapper usages, then compare the relevant deserialization setup with the linked Apache Drill example. Determine which ObjectMapper paths accept polymorphic types and add restrictions so only approved classes can be loaded; verify the affected security behavior with the existing tests.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- java
- Domain
- security
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Quiet
- Clarity
- Mostly clear
- Newbie friendliness
- 52/100