Class DefaultBaseTypeLimitingValidator

java.lang.Object

tools.jackson.databind.jsontype.PolymorphicTypeValidator

tools.jackson.databind.jsontype.DefaultBaseTypeLimitingValidator

All Implemented Interfaces:

Serializable

public class DefaultBaseTypeLimitingValidator
extends PolymorphicTypeValidator
implements Serializable

PolymorphicTypeValidator that will only allow polymorphic handling if the base type is NOT one of potential dangerous base types (see isUnsafeBaseType(DatabindContext, JavaType) for specific list of such base types).

This implementation is the default one used for annotation-based polymorphic deserialization. Default Typing requires explicit registration of validator; while this implementation may be used users are recommended to either use a custom implementation or sub-class this implementation and override either validateSubClassName(DatabindContext, JavaType, String) or validateSubType(DatabindContext, JavaType, JavaType) to implement use-case specific validation.

Note that when using potentially unsafe base type like Object a custom implementation (or subtype with override) is needed. Most commonly subclasses would override both isUnsafeBaseType(DatabindContext, JavaType) and isSafeSubType(DatabindContext, JavaType, JavaType): former to allow all (or just more) base types, and latter to add actual validation of subtype.

See Also:

• Serialized Form

Nested Class Summary

Nested Classes

Modifier and Type	Class	Description
private static final class	DefaultBaseTypeLimitingValidator.UnsafeBaseTypes

Nested classes/interfaces inherited from class PolymorphicTypeValidator

PolymorphicTypeValidator.Base, PolymorphicTypeValidator.Validity

Field Summary

Fields

Modifier and Type	Field	Description
private static final long	serialVersionUID

Constructor Summary

Constructors

Constructor	Description
DefaultBaseTypeLimitingValidator()

Method Summary

Modifier and Type	Method	Description
protected boolean	isSafeSubType(DatabindContext ctxt, JavaType baseType, JavaType subType)	Helper called to determine whether given actual subtype is considered safe to process: this will only be called if subtype was considered acceptable earlier.
protected boolean	isUnsafeBaseType(DatabindContext ctxt, JavaType baseType)	Helper method called to determine if the given base type is known to be problematic regarding possible "gadget types".
PolymorphicTypeValidator.Validity	validateBaseType(DatabindContext ctxt, JavaType baseType)	Method called when a property with polymorphic value is encountered, and a TypeResolverBuilder is needed.
PolymorphicTypeValidator.Validity	validateSubClassName(DatabindContext ctxt, JavaType baseType, String subClassName)	Method called after intended class name for subtype has been read (and in case of minimal class name, expanded to fully-qualified class name) but before attempt is made to look up actual Class or JavaType.
PolymorphicTypeValidator.Validity	validateSubType(DatabindContext ctxt, JavaType baseType, JavaType subType)	Method called after class name has been resolved to actual type, in cases where previous call to PolymorphicTypeValidator.validateSubClassName(DatabindContext, JavaType, String) returned PolymorphicTypeValidator.Validity.INDETERMINATE.

Methods inherited from class Object

clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait

Field Details

serialVersionUID

private static final long serialVersionUID

See Also:

• Constant Field Values

Constructor Details

DefaultBaseTypeLimitingValidator

public DefaultBaseTypeLimitingValidator()

Method Details

validateBaseType

public PolymorphicTypeValidator.Validity validateBaseType(DatabindContext ctxt,
 JavaType baseType)

Description copied from class: PolymorphicTypeValidator

Method called when a property with polymorphic value is encountered, and a TypeResolverBuilder is needed. Intent is to allow early determination of cases where subtyping is completely denied (for example for security reasons), or, conversely, allowed for allow subtypes (when base type guarantees that all subtypes are known to be safe). Check can be thought of as both optimization (for latter case) and eager-fail (for former case) to give better feedback.

Specified by:

validateBaseType in class PolymorphicTypeValidator

Parameters:

ctxt - Context for resolution: typically will be DeserializationContext

baseType - Nominal base type used for polymorphic handling: subtypes MUST be instances of this type and assignment compatibility is verified by Jackson core

Returns:

Determination of general validity of all subtypes of given base type; if PolymorphicTypeValidator.Validity.ALLOWED returned, all subtypes will automatically be accepted without further checks; is PolymorphicTypeValidator.Validity.DENIED returned no subtyping allowed at all (caller will usually throw an exception); otherwise (return PolymorphicTypeValidator.Validity.INDETERMINATE) per sub-type validation calls are made for each new subclass encountered.

validateSubClassName

public PolymorphicTypeValidator.Validity validateSubClassName(DatabindContext ctxt,
 JavaType baseType,
 String subClassName)

Description copied from class: PolymorphicTypeValidator

Method called after intended class name for subtype has been read (and in case of minimal class name, expanded to fully-qualified class name) but before attempt is made to look up actual Class or JavaType. Validator may be able to determine validity of eventual type (and return PolymorphicTypeValidator.Validity.ALLOWED or PolymorphicTypeValidator.Validity.DENIED) or, if not able to, can defer validation to actual resolved type by returning PolymorphicTypeValidator.Validity.INDETERMINATE.

Validator may also choose to indicate denial by throwing a DatabindException (such as InvalidTypeIdException)

Specified by:

validateSubClassName in class PolymorphicTypeValidator

Parameters:

ctxt - Context for resolution: typically will be DeserializationContext

baseType - Nominal base type used for polymorphic handling: subtypes MUST be instances of this type and assignment compatibility is verified by Jackson core

subClassName - Name of class that will be resolved to Class if (and only if) validity check is not denied.

Returns:

Determination of validity of given class name, as a subtype of given base type: should NOT return null

validateSubType

public PolymorphicTypeValidator.Validity validateSubType(DatabindContext ctxt,
 JavaType baseType,
 JavaType subType)

Description copied from class: PolymorphicTypeValidator

Method called after class name has been resolved to actual type, in cases where previous call to PolymorphicTypeValidator.validateSubClassName(DatabindContext, JavaType, String) returned PolymorphicTypeValidator.Validity.INDETERMINATE. Validator should be able to determine validity and return appropriate PolymorphicTypeValidator.Validity value, although it may also

Validator may also choose to indicate denial by throwing a DatabindException (such as InvalidTypeIdException)

Specified by:

validateSubType in class PolymorphicTypeValidator

Parameters:

ctxt - Context for resolution: typically will be DeserializationContext

baseType - Nominal base type used for polymorphic handling: subtypes MUST be instances of this type and assignment compatibility has been verified by Jackson core

subType - Resolved subtype to validate

Returns:

Determination of validity of given class name, as a subtype of given base type: should NOT return null

isUnsafeBaseType

protected boolean isUnsafeBaseType(DatabindContext ctxt,
 JavaType baseType)

Helper method called to determine if the given base type is known to be problematic regarding possible "gadget types". Currently includes following types:

• Object
• Closeable
• Serializable
• AutoCloseable
• Cloneable
• Handler
• Referenceable
• DataSource

which are JDK-included super types of at least one gadget type (not necessarily included in JDK)

Parameters:

ctxt - Processing context (to give access to configuration)

baseType - Base type to test

isSafeSubType

protected boolean isSafeSubType(DatabindContext ctxt,
 JavaType baseType,
 JavaType subType)

Helper called to determine whether given actual subtype is considered safe to process: this will only be called if subtype was considered acceptable earlier.

Parameters:

ctxt - Processing context (to give access to configuration)

baseType - Base type of sub type (validated earlier)

subType - Sub type to test