pjfanning opened a new pull request, #1310:
URL: https://github.com/apache/curator/pull/1310
Fixes #1297
`ServiceInstance#getPayload()` (and `OldServiceInstance`) is annotated with
`@JsonTypeInfo(use = JsonTypeInfo.Id.CLASS)`, so `JsonInstanceSerializer` would
load any class named in the JSON, relying only on Jackson's built-in gadget
deny-list.
### Changes
- `JsonInstanceSerializer` now sets a `PolymorphicTypeValidator` on its
`ObjectMapper`. By default:
- polymorphic values with an `Object` base type (i.e. the erased payload
`T`) must be the configured `payloadClass` or a subtype; anything else fails
with `InvalidTypeIdException`
- polymorphic values with any other declared base type (e.g. a nested
`@JsonTypeInfo` field inside the user's payload) are allowed as before, so
existing payloads with their own typed fields keep working
- New public constructor `JsonInstanceSerializer(Class<T>, boolean,
PolymorphicTypeValidator)` for users who need a different policy.
- Users who pass `Object.class` as the payload class keep the previous
(permissive) behaviour; they can use the new constructor to lock it down.
### Tests
- disallowed payload class is rejected
- custom validator allows/denies as configured
- payload with a nested `Id.CLASS` field still round-trips
🤖 Generated with [Claude Code](https://claude.com/claude-code)
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
