Skip to content

Add Deserializers.hasDeserializerFor() (and something for DeserializerFactory) to allow detection of explicitly supported types #2539

@cowtowncoder

Description

@cowtowncoder

Addition of "Safe Default Typing" in 2.10 is good for security, but can add complexity to actual allow-listing of types considered safe for purposes of polymorphic deserialization.

One thing that could significantly simplify adding rules would be ability to figure out types supported with explicit deserializers, provided by modules (esp. datatype ones). This should indicate all explicitly handled cases, but specifically NOT introspection based "POJO" (and similar for Scala, Kotlin) values.
If support method was added in Deserializers (and something for DeserializerFactory), we could add a mechanism in BasicPolymorphicTypeValidator to indicate something like "if type is explicitly supported, allow. This would then support things like:

  1. Basic JDK String-like types (java.net.URL, java.util.UUID)
  2. Basic (JDK) date/time types (java.util.Date / Calendar)
  3. Strings, Booleans, number wrappers
  4. JsonNode types.

and 3rd party types of Joda, Guava, etc.

Metadata

Metadata

Assignees

No one assigned

    Labels

    3.xIssues to be only tackled for Jackson 3.x, not 2.x

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions