You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Addition of "Safe Default Typing" in 2.10 is good for security, but can add complexity to actual allow-listing of types considered safe for purposes of polymorphic deserialization.
One thing that could significantly simplify adding rules would be ability to figure out types supported with explicit deserializers, provided by modules (esp. datatype ones). This should indicate all explicitly handled cases, but specifically NOT introspection based "POJO" (and similar for Scala, Kotlin) values.
If support method was added in Deserializers (and something for DeserializerFactory), we could add a mechanism in BasicPolymorphicTypeValidator to indicate something like "if type is explicitly supported, allow. This would then support things like: