com.fasterxml.jackson.databind.jsontype.impl

Class SubTypeValidator

java.lang.Object

com.fasterxml.jackson.databind.jsontype.impl.SubTypeValidator

public class SubTypeValidator
extends Object

Helper class used to encapsulate rules that determine subtypes that are invalid to use, even with default typing, mostly due to security concerns. Used by BeanDeserializerFactory

Since:

2.8.11

Field Summary

Fields

Modifier and Type	Field and Description
protected Set<String>	_cfgIllegalClassNames Set of class names of types that are never to be deserialized.
protected static Set<String>	DEFAULT_NO_DESER_CLASS_NAMES Set of well-known "nasty classes", deserialization of which is considered dangerous and should (and is) prevented by default.
protected static String	PREFIX_C3P0
protected static String	PREFIX_SPRING

Constructor Summary

Constructors

Modifier	Constructor and Description
protected	SubTypeValidator()

Method Summary

Modifier and Type	Method and Description
static SubTypeValidator	instance()
boolean	isIllegalType(Class<?> raw) Method for checking whether given class is one of known "gadget" types that are never to be deserialized.
void	validateSubType(DeserializationContext ctxt, JavaType type, BeanDescription beanDesc)

Methods inherited from class java.lang.Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Field Detail

PREFIX_SPRING

protected static final String PREFIX_SPRING

See Also:

Constant Field Values

PREFIX_C3P0

protected static final String PREFIX_C3P0

See Also:

Constant Field Values

DEFAULT_NO_DESER_CLASS_NAMES

protected static final Set<String> DEFAULT_NO_DESER_CLASS_NAMES

Set of well-known "nasty classes", deserialization of which is considered dangerous and should (and is) prevented by default.

_cfgIllegalClassNames

protected Set<String> _cfgIllegalClassNames

Set of class names of types that are never to be deserialized.

Constructor Detail

SubTypeValidator

protected SubTypeValidator()

Method Detail

instance

public static SubTypeValidator instance()

validateSubType

public void validateSubType(DeserializationContext ctxt,
                            JavaType type,
                            BeanDescription beanDesc)
                     throws JsonMappingException

Throws:

JsonMappingException

isIllegalType

public boolean isIllegalType(Class<?> raw)

Method for checking whether given class is one of known "gadget" types that are never to be deserialized.

Since:

2.18.12