This is an automated email from the ASF dual-hosted git repository.
cgivre pushed a commit to branch master
in repository https://gitbox.apache.org/repos/asf/drill.git
The following commit(s) were added to refs/heads/master by this push:
new 5d47ac3357 [DRILL-8549] Add Jackson validation of polymorphic types.
(#3057)
5d47ac3357 is described below
commit 5d47ac335785147d4b64a71db7d90df8aed73e91
Author: PJ Fanning <[email protected]>
AuthorDate: Thu Aug 20 03:37:40 2026 +0100
[DRILL-8549] Add Jackson validation of polymorphic types. (#3057)
* DRILL-8549. Add Jackson validation of polymorphic types.
* Update pom.xml
* Update JacksonUtils.java
* Update JacksonUtils.java
* refactor
* Update StatisticsHolder.java
* Update StatisticsHolder.java
* Update StatisticsHolder.java
* refactor
* try to fix broken test
* refactor
* Clean up comments in createJsonMapperBuilder method
Removed comments explaining the polymorphicTypeValidator usage.
---
.../org/apache/drill/common/util/JacksonUtils.java | 23 ++++++++++++++++++++--
.../exec/store/DrillbitPluginRegistryContext.java | 2 +-
.../common/config/LogicalPlanPersistence.java | 8 ++++----
.../metastore/statistics/ColumnStatistics.java | 7 ++++---
pom.xml | 2 +-
5 files changed, 31 insertions(+), 11 deletions(-)
diff --git
a/common/src/main/java/org/apache/drill/common/util/JacksonUtils.java
b/common/src/main/java/org/apache/drill/common/util/JacksonUtils.java
index e0cb0dee80..e3fdb32eb0 100644
--- a/common/src/main/java/org/apache/drill/common/util/JacksonUtils.java
+++ b/common/src/main/java/org/apache/drill/common/util/JacksonUtils.java
@@ -20,6 +20,8 @@ package org.apache.drill.common.util;
import com.fasterxml.jackson.core.JsonFactory;
import com.fasterxml.jackson.databind.ObjectMapper;
import com.fasterxml.jackson.databind.json.JsonMapper;
+import com.fasterxml.jackson.databind.jsontype.BasicPolymorphicTypeValidator;
+import com.fasterxml.jackson.databind.jsontype.PolymorphicTypeValidator;
/**
* Utility class which contain methods for interacting with Jackson.
@@ -50,7 +52,8 @@ public final class JacksonUtils {
* @return an {@link JsonMapper.Builder} instance
*/
public static JsonMapper.Builder createJsonMapperBuilder() {
- return JsonMapper.builder();
+ return JsonMapper.builder()
+ .polymorphicTypeValidator(createPolymorphicTypeValidator());
}
/**
@@ -59,6 +62,22 @@ public final class JacksonUtils {
* @return an {@link JsonMapper.Builder} instance
*/
public static JsonMapper.Builder createJsonMapperBuilder(final JsonFactory
factory) {
- return JsonMapper.builder(factory);
+ return JsonMapper.builder(factory)
+ .polymorphicTypeValidator(createPolymorphicTypeValidator());
}
+
+ // The more restrictive this validator is, the better for security.
+ private static PolymorphicTypeValidator createPolymorphicTypeValidator() {
+ return BasicPolymorphicTypeValidator.builder()
+ .allowIfSubType(Number.class)
+ .allowIfSubType(Boolean.class)
+ .allowIfSubType(String.class)
+ .allowIfSubType(byte[].class)
+ .allowIfSubType("java.time.")
+ .allowIfSubType("org.joda.time.") // Joda used by ColumnStatistics
+ .allowIfSubType("org.apache.drill.exec.")
+ .allowIfSubType("org.apache.drill.metastore.")
+ .build();
+ }
+
}
diff --git
a/exec/java-exec/src/main/java/org/apache/drill/exec/store/DrillbitPluginRegistryContext.java
b/exec/java-exec/src/main/java/org/apache/drill/exec/store/DrillbitPluginRegistryContext.java
index 4565b55fa7..44e9bb98d0 100644
---
a/exec/java-exec/src/main/java/org/apache/drill/exec/store/DrillbitPluginRegistryContext.java
+++
b/exec/java-exec/src/main/java/org/apache/drill/exec/store/DrillbitPluginRegistryContext.java
@@ -45,7 +45,7 @@ public class DrillbitPluginRegistryContext implements
PluginRegistryContext {
// to handle HOCON format in the override file
LogicalPlanPersistence persistence = new
LogicalPlanPersistence(drillbitContext.getConfig(),
drillbitContext.getClasspathScan(),
- JacksonUtils.createObjectMapper(new HoconFactory()));
+ JacksonUtils.createJsonMapperBuilder(new HoconFactory()).build());
hoconMapper = persistence.getMapper();
}
diff --git
a/logical/src/main/java/org/apache/drill/common/config/LogicalPlanPersistence.java
b/logical/src/main/java/org/apache/drill/common/config/LogicalPlanPersistence.java
index 903b8f014f..4854871496 100644
---
a/logical/src/main/java/org/apache/drill/common/config/LogicalPlanPersistence.java
+++
b/logical/src/main/java/org/apache/drill/common/config/LogicalPlanPersistence.java
@@ -65,9 +65,9 @@ public class LogicalPlanPersistence {
mapper.setInjectableValues(injectables);
mapper.registerModule(deserModule);
mapper.enable(SerializationFeature.INDENT_OUTPUT);
- mapper.configure(Feature.ALLOW_UNQUOTED_FIELD_NAMES, true);
- mapper.configure(JsonGenerator.Feature.QUOTE_FIELD_NAMES, true);
- mapper.configure(Feature.ALLOW_COMMENTS, true);
+ mapper.enable(Feature.ALLOW_UNQUOTED_FIELD_NAMES);
+ mapper.enable(JsonGenerator.Feature.QUOTE_FIELD_NAMES);
+ mapper.enable(Feature.ALLOW_COMMENTS);
mapper.setFilterProvider(new
SimpleFilterProvider().setFailOnUnknownId(false));
// For LogicalOperatorBase
registerSubtypes(getSubTypes(scanResult, LogicalOperator.class));
@@ -92,7 +92,7 @@ public class LogicalPlanPersistence {
* Scan for implementations of the given interface.
*
* @param classpathScan Drill configuration object used to find the packages
to scan
- * @return list of classes that implement the interface.
+ * @return set of classes that implement the interface.
*/
public static <T> Set<Class<? extends T>> getSubTypes(final ScanResult
classpathScan, Class<T> parent) {
Set<Class<? extends T>> subclasses =
classpathScan.getImplementations(parent);
diff --git
a/metastore/metastore-api/src/main/java/org/apache/drill/metastore/statistics/ColumnStatistics.java
b/metastore/metastore-api/src/main/java/org/apache/drill/metastore/statistics/ColumnStatistics.java
index b909280a5e..beb3e4eb2d 100644
---
a/metastore/metastore-api/src/main/java/org/apache/drill/metastore/statistics/ColumnStatistics.java
+++
b/metastore/metastore-api/src/main/java/org/apache/drill/metastore/statistics/ColumnStatistics.java
@@ -67,9 +67,10 @@ import java.util.stream.Collectors;
@JsonPropertyOrder({"statistics", "comparator"})
public class ColumnStatistics<T> {
- private static final ObjectMapper MAPPER =
JacksonUtils.createJsonMapperBuilder()
- .addModule(new JodaModule())
- .build();
+ private static final ObjectMapper MAPPER =
+ JacksonUtils.createJsonMapperBuilder()
+ .addModule(new JodaModule())
+ .build();
private static final ObjectWriter OBJECT_WRITER =
MAPPER.writerFor(ColumnStatistics.class);
diff --git a/pom.xml b/pom.xml
index 08688e4de3..90d833ccd2 100644
--- a/pom.xml
+++ b/pom.xml
@@ -98,7 +98,7 @@
<httpdlog-parser.version>5.11.0</httpdlog-parser.version>
<iceberg.version>0.12.1</iceberg.version>
<paimon.version>1.3.1</paimon.version>
- <jackson.version>2.18.3</jackson.version>
+ <jackson.version>2.18.9</jackson.version>
<janino.version>3.1.12</janino.version>
<javassist.version>3.29.2-GA</javassist.version>
<javax.el.version>3.0.0</javax.el.version>
