PJ Fanning created FINERACT-2949:
------------------------------------
Summary: apply Jackson PolymorphicTypeValidator
Key: FINERACT-2949
URL: https://issues.apache.org/jira/browse/FINERACT-2949
Project: Apache Fineract
Issue Type: Task
Reporter: PJ Fanning
Polymorphic deserialization means the JSON itself says which Java class to
create. This happens with `@JsonTypeInfo(use = Id.CLASS)`.
```json
{"@class": "com.example.SomeClass", "field": "value"}
```
If the class name comes from untrusted input, then arbitrary classes can be
loaded.
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
