spring-projects / spring-projects/spring-security
Explore the use of the jackson PolymorphicTypeValidator
Nobody has claimed this yet.
- Dominant language
- Java
- Stars
- 9.6k
- Forks
- 6.3k
- Avg merge
- 2d 11h
- Merged PRs (30d)
- 52
Description
Currently Spring Security goes through the class white list in the TypeIdResolver
This may or may not be simplified using a PolymorphicTypeValidator
In the current code structure, the validator is invoked when the type is resolved, thus the white list from the mixins is never evaluated.
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start with SecurityJackson2Modules.java, especially the TypeIdResolver around lines 210-230, and compare it with the referenced PolymorphicTypeValidator commit. Determine whether the validator can simplify or correctly replace the mixin whitelist, and consider the issue complete when the intended validation behavior and resulting design are established.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- java, spring
- Domain
- security
- Issue type
- Refactor
- Difficulty
- 5/5
- Estimated time
- Over a week
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 25/100