[
https://issues.apache.org/jira/browse/KYLIN-6092?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=18109750#comment-18109750
]
ASF GitHub Bot commented on KYLIN-6092:
---------------------------------------
pjfanning commented on code in PR #2354:
URL: https://github.com/apache/kylin/pull/2354#discussion_r3891479690
##########
src/core-common/src/main/java/org/apache/kylin/common/util/JsonUtil.java:
##########
@@ -60,33 +62,43 @@
public class JsonUtil {
// reuse the object mapper to save memory footprint
- private static final ObjectMapper mapper = new ObjectMapper();
- private static final ObjectMapper indentMapper = new ObjectMapper();
+ private static final ObjectMapper MAPPER = new ObjectMapper();
Review Comment:
The code would be more future proof if you use Jackson's
JsonMapper.builder() to configure the mappers. The APIs are heading this way to
suit Jackson 3 where mappers are immutable.
A simplified example.
```
private static final ObjectMapper MAPPER = JsonMapper.builder()
.addModule(new GuavaModule())
.polymorphicTypeValidator(KYLIN_TYPE_VALIDATOR)
.filterProvider(simpleFilterProvider)
.typeFactory(customTypeFactory)
.disable(DeserializationFeature.FAIL_ON_UNKNOWN_PROPERTIES)
.build();
```
I'm not sure of all method names on JsonMapper.Builder but this is
approximately what it looks like.
> Insecure Jackson deserialization
> --------------------------------
>
> Key: KYLIN-6092
> URL: https://issues.apache.org/jira/browse/KYLIN-6092
> Project: Kylin
> Issue Type: Task
> Reporter: PJ Fanning
> Assignee: Longfei Jiang
> Priority: Major
>
> [https://github.com/apache/kylin/blob/b5b94b51abaf83d68088e4fcab606d2a6530e54d/src/core-common/src/main/java/org/apache/kylin/common/persistence/event/Event.java#L33]
> `@JsonTypeInfo(use = JsonTypeInfo.Id.CLASS)` – when you deserialize the
> `@class` value that appears in the JSON can be any class name and Jackson
> will load that class and try to create an instance.
> You should add a polymorphic type validator to your ObjectMapper that
> restricts which classes can be loaded at deserialization time.
> https://fasterxml.github.io/jackson-databind/javadoc/2.10/com/fasterxml/jackson/databind/jsontype/BasicPolymorphicTypeValidator.html
>
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
