Complete refactoring of default typing changes (wrt #2195)

FasterXML · May 2, 2019 · 9da1f1b · 9da1f1b
1 parent f9b2907
commit 9da1f1b
Show file tree

Hide file tree

Showing 28 changed files with 194 additions and 92 deletions.
diff --git a/src/main/java/com/fasterxml/jackson/databind/ObjectMapper.java b/src/main/java/com/fasterxml/jackson/databind/ObjectMapper.java
@@ -190,7 +190,7 @@ public enum DefaultTyping {
     /**
      * Customized {@link TypeResolverBuilder} that provides type resolver builders
      * used with so-called "default typing"
-     * (see {@link ObjectMapper#enableDefaultTyping()} for details).
+     * (see {@link ObjectMapper#enableDefaultTyping(PolymorphicTypeValidator)} for details).
      *<p>
      * Type resolver construction is based on configuration: implementation takes care
      * of only providing builders in cases where type information should be applied.
@@ -1415,7 +1415,9 @@ public void setVisibilityChecker(VisibilityChecker<?> vc) {
 
     /**
      * Method for specifying {@link PolymorphicTypeValidator} to use for validating
-     * polymorphic subtypes on deserialization.
+     * polymorphic subtypes used with explicit polymorphic types (annotation-based),
+     * but NOT one with "default typing" (see {@link #enableDefaultTyping(PolymorphicTypeValidator)}
+     * for details).
      *
      * @since 2.10
      */
@@ -1426,6 +1428,11 @@ public ObjectMapper setPolymorphicTypeValidator(PolymorphicTypeValidator ptv) {
     }
 
     /**
+     * Accessor for configured {@link PolymorphicTypeValidator} used for validating
+     * polymorphic subtypes used with explicit polymorphic types (annotation-based),
+     * but NOT one with "default typing" (see {@link #enableDefaultTyping(PolymorphicTypeValidator)}
+     * for details).
+     *
      * @since 2.10
      */
     public PolymorphicTypeValidator getPolymorphicTypeValidator() {
@@ -1568,12 +1575,15 @@ public void registerSubtypes(Collection<Class<?>> subtypes) {
     /**
      * Convenience method that is equivalent to calling
      *<pre>
-     *  enableDefaultTyping(DefaultTyping.OBJECT_AND_NON_CONCRETE);
+     *  enableDefaultTyping(ptv, DefaultTyping.OBJECT_AND_NON_CONCRETE);
      *</pre>
      *<p>
      * NOTE: choice of {@link PolymorphicTypeValidator} to pass is critical for security
      * as allowing all subtypes can be risky for untrusted content.
      *
+     * @param ptv Validator used to verify that actual subtypes to deserialize are valid against
+     *    whatever criteria validator uses: important in case where untrusted content is deserialized.
+     *
      * @since 2.10
      */
     public ObjectMapper enableDefaultTyping(PolymorphicTypeValidator ptv) {
@@ -1583,17 +1593,22 @@ public ObjectMapper enableDefaultTyping(PolymorphicTypeValidator ptv) {
     /**
      * Convenience method that is equivalent to calling
      *<pre>
-     *  enableDefaultTyping(dti, JsonTypeInfo.As.WRAPPER_ARRAY);
+     *  enableDefaultTyping(ptv, dti, JsonTypeInfo.As.WRAPPER_ARRAY);
      *</pre>
      *<p>
      * NOTE: choice of {@link PolymorphicTypeValidator} to pass is critical for security
      * as allowing all subtypes can be risky for untrusted content.
      *
+     * @param ptv Validator used to verify that actual subtypes to deserialize are valid against
+     *    whatever criteria validator uses: important in case where untrusted content is deserialized.
+     * @param applicability Defines kinds of types for which additional type information
+     *    is added; see {@link DefaultTyping} for more information.
+     *
      * @since 2.10
      */
     public ObjectMapper enableDefaultTyping(PolymorphicTypeValidator ptv,
-            DefaultTyping dti) {
-        return enableDefaultTyping(ptv, dti, JsonTypeInfo.As.WRAPPER_ARRAY);
+            DefaultTyping applicability) {
+        return enableDefaultTyping(ptv, applicability, JsonTypeInfo.As.WRAPPER_ARRAY);
     }
 
     /**
@@ -1607,9 +1622,12 @@ public ObjectMapper enableDefaultTyping(PolymorphicTypeValidator ptv,
      *<p>
      * NOTE: choice of {@link PolymorphicTypeValidator} to pass is critical for security
      * as allowing all subtypes can be risky for untrusted content.
-     * 
+     *
+     * @param ptv Validator used to verify that actual subtypes to deserialize are valid against
+     *    whatever criteria validator uses: important in case where untrusted content is deserialized.
      * @param applicability Defines kinds of types for which additional type information
      *    is added; see {@link DefaultTyping} for more information.
+     * @param includeAs
      *
      * @since 2.10
      */
@@ -1640,6 +1658,12 @@ public ObjectMapper enableDefaultTyping(PolymorphicTypeValidator ptv,
      * NOTE: choice of {@link PolymorphicTypeValidator} to pass is critical for security
      * as allowing all subtypes can be risky for untrusted content.
      *
+     * @param ptv Validator used to verify that actual subtypes to deserialize are valid against
+     *    whatever criteria validator uses: important in case where untrusted content is deserialized.
+     * @param applicability Defines kinds of types for which additional type information
+     *    is added; see {@link DefaultTyping} for more information.
+     * @param propertyName Name of property used for including type id for polymorphic values.
+     *
      * @since 2.10
      */
     public ObjectMapper enableDefaultTypingAsProperty(PolymorphicTypeValidator ptv,

diff --git a/...com/fasterxml/jackson/databind/deser/creators/ArrayDelegatorCreatorForCollectionTest.java b/...com/fasterxml/jackson/databind/deser/creators/ArrayDelegatorCreatorForCollectionTest.java
@@ -6,6 +6,7 @@
 import com.fasterxml.jackson.annotation.*;
 
 import com.fasterxml.jackson.databind.*;
+import com.fasterxml.jackson.databind.testutil.NoCheckSubTypeValidator;
 
 // for [databind#1392] (regression in 2.7 due to separation of array-delegating creator)
 public class ArrayDelegatorCreatorForCollectionTest extends BaseMapTest
@@ -22,7 +23,8 @@ public void testUnmodifiable() throws Exception
         ObjectMapper mapper = new ObjectMapper();
         Class<?> unmodSetType = Collections.unmodifiableSet(Collections.<String>emptySet()).getClass();
         mapper.addMixIn(unmodSetType, UnmodifiableSetMixin.class);
-        mapper.enableDefaultTyping(ObjectMapper.DefaultTyping.NON_FINAL, JsonTypeInfo.As.PROPERTY);
+        mapper.enableDefaultTyping(NoCheckSubTypeValidator.instance,
+                ObjectMapper.DefaultTyping.NON_FINAL, JsonTypeInfo.As.PROPERTY);
 
         final String EXPECTED_JSON = "[\""+unmodSetType.getName()+"\",[]]";
 

diff --git a/...java/com/fasterxml/jackson/databind/deser/filter/ProblemHandlerUnknownTypeId2221Test.java b/...java/com/fasterxml/jackson/databind/deser/filter/ProblemHandlerUnknownTypeId2221Test.java
@@ -10,6 +10,7 @@
 import com.fasterxml.jackson.databind.*;
 import com.fasterxml.jackson.databind.deser.DeserializationProblemHandler;
 import com.fasterxml.jackson.databind.jsontype.TypeIdResolver;
+import com.fasterxml.jackson.databind.testutil.NoCheckSubTypeValidator;
 
 // for [databind#2221]
 public class ProblemHandlerUnknownTypeId2221Test extends BaseMapTest
@@ -84,7 +85,7 @@ public String toString() {
 
     public void testWithDeserializationProblemHandler() throws Exception {
         final ObjectMapper mapper = new ObjectMapper()
-                .enableDefaultTyping();
+                .enableDefaultTyping(NoCheckSubTypeValidator.instance);
         mapper.addHandler(new DeserializationProblemHandler() {
             @Override
             public JavaType handleUnknownTypeId(DeserializationContext ctxt, JavaType baseType, String subTypeId, TypeIdResolver idResolver, String failureMsg) throws IOException {
@@ -100,7 +101,7 @@ public JavaType handleUnknownTypeId(DeserializationContext ctxt, JavaType baseTy
     public void testWithDisabledFAIL_ON_INVALID_SUBTYPE() throws Exception {
         final ObjectMapper mapper = new ObjectMapper()
                 .disable(DeserializationFeature.FAIL_ON_INVALID_SUBTYPE)
-                .enableDefaultTyping()
+                .enableDefaultTyping(NoCheckSubTypeValidator.instance)
         ;
         GenericContent processableContent = mapper.readValue(JSON, GenericContent.class);
         assertNotNull(processableContent.getInnerObjects());

diff --git a/src/test/java/com/fasterxml/jackson/databind/deser/jdk/JDKCollectionsDeserTest.java b/src/test/java/com/fasterxml/jackson/databind/deser/jdk/JDKCollectionsDeserTest.java
@@ -7,6 +7,7 @@
 import com.fasterxml.jackson.core.type.TypeReference;
 
 import com.fasterxml.jackson.databind.*;
+import com.fasterxml.jackson.databind.testutil.NoCheckSubTypeValidator;
 
 /**
  * Tests for special collection/map types via `java.util.Collections`
@@ -49,8 +50,10 @@ public void testSingletonCollections() throws Exception
     // [databind#1868]: Verify class name serialized as is
     public void testUnmodifiableSet() throws Exception
     {
-        ObjectMapper mapper = new ObjectMapper();
-        mapper.enableDefaultTyping(ObjectMapper.DefaultTyping.NON_FINAL, JsonTypeInfo.As.PROPERTY);
+        ObjectMapper mapper = jsonMapperBuilder()
+                .enableDefaultTyping(NoCheckSubTypeValidator.instance,
+                        ObjectMapper.DefaultTyping.NON_FINAL, JsonTypeInfo.As.PROPERTY)
+                .build();
 
         Set<String> theSet = Collections.unmodifiableSet(Collections.singleton("a"));
         String json = mapper.writeValueAsString(theSet);

diff --git a/src/test/java/com/fasterxml/jackson/databind/deser/jdk/UntypedDeserializationTest.java b/src/test/java/com/fasterxml/jackson/databind/deser/jdk/UntypedDeserializationTest.java
@@ -16,6 +16,7 @@
 import com.fasterxml.jackson.databind.deser.std.StdDeserializer;
 import com.fasterxml.jackson.databind.deser.std.StdScalarDeserializer;
 import com.fasterxml.jackson.databind.module.SimpleModule;
+import com.fasterxml.jackson.databind.testutil.NoCheckSubTypeValidator;
 
 /**
  * Unit tests for verifying "raw" (or "untyped") data binding from JSON to JDK objects;
@@ -225,7 +226,8 @@ public void testNestedUntypes() throws IOException
     public void testObjectSerializeWithLong() throws IOException
     {
         final ObjectMapper mapper = new ObjectMapper();
-        mapper.enableDefaultTyping(DefaultTyping.JAVA_LANG_OBJECT, As.PROPERTY);
+        mapper.enableDefaultTyping(NoCheckSubTypeValidator.instance,
+                DefaultTyping.JAVA_LANG_OBJECT, As.PROPERTY);
         final long VALUE = 1337800584532L;
 
         String serialized = "{\"timestamp\":"+VALUE+"}";

diff --git a/src/test/java/com/fasterxml/jackson/databind/ext/TestJava7Types.java b/src/test/java/com/fasterxml/jackson/databind/ext/TestJava7Types.java
@@ -5,6 +5,7 @@
 
 import com.fasterxml.jackson.databind.*;
 import com.fasterxml.jackson.databind.ObjectMapper.DefaultTyping;
+import com.fasterxml.jackson.databind.testutil.NoCheckSubTypeValidator;
 
 /**
  * @since 2.7
@@ -30,8 +31,10 @@ public void testPathRoundtrip() throws Exception
     // [databind#1688]:
     public void testPolymorphicPath() throws Exception
     {
-        ObjectMapper mapper = new ObjectMapper();
-        mapper.enableDefaultTyping(DefaultTyping.NON_FINAL);
+        ObjectMapper mapper = jsonMapperBuilder()
+                .enableDefaultTyping(NoCheckSubTypeValidator.instance,
+                        DefaultTyping.NON_FINAL)
+                .build();
         Path input = Paths.get("/tmp", "foo.txt");
 
         String json = mapper.writeValueAsString(new Object[] { input });

diff --git a/src/test/java/com/fasterxml/jackson/databind/interop/IllegalTypesCheckTest.java b/src/test/java/com/fasterxml/jackson/databind/interop/IllegalTypesCheckTest.java
@@ -9,7 +9,7 @@
 import com.fasterxml.jackson.annotation.JsonTypeInfo;
 import com.fasterxml.jackson.databind.*;
 import com.fasterxml.jackson.databind.exc.InvalidDefinitionException;
-
+import com.fasterxml.jackson.databind.testutil.NoCheckSubTypeValidator;
 import com.mchange.v2.c3p0.jacksontest.ComboPooledDataSource;
 
 /**
@@ -58,7 +58,7 @@ public void testXalanTypes1599() throws Exception
 +"}"
         );
         ObjectMapper mapper = new ObjectMapper();
-        mapper.enableDefaultTyping();
+        mapper.enableDefaultTyping(NoCheckSubTypeValidator.instance);
         try {
             mapper.readValue(JSON, Bean1599.class);
             fail("Should not pass");
@@ -105,8 +105,10 @@ public void testSpringTypes1737() throws Exception
     // // // Tests for [databind#1872]
     public void testJDKTypes1872() throws Exception
     {
-        ObjectMapper mapper = new ObjectMapper();
-        mapper.enableDefaultTyping(ObjectMapper.DefaultTyping.NON_FINAL, JsonTypeInfo.As.PROPERTY);
+        ObjectMapper mapper = jsonMapperBuilder()
+                .enableDefaultTyping(NoCheckSubTypeValidator.instance,
+                        ObjectMapper.DefaultTyping.NON_FINAL, JsonTypeInfo.As.PROPERTY)
+                .build();
 
         String json = aposToQuotes(String.format("{'@class':'%s','authorities':['java.util.ArrayList',[]]}",
                 Authentication1872.class.getName()));

diff --git a/src/test/java/com/fasterxml/jackson/databind/jsontype/NoTypeInfoTest.java b/src/test/java/com/fasterxml/jackson/databind/jsontype/NoTypeInfoTest.java
@@ -4,6 +4,7 @@
 
 import com.fasterxml.jackson.databind.*;
 import com.fasterxml.jackson.databind.annotation.JsonDeserialize;
+import com.fasterxml.jackson.databind.testutil.NoCheckSubTypeValidator;
 
 public class NoTypeInfoTest extends BaseMapTest
 {
@@ -24,8 +25,9 @@ final static class NoType implements NoTypeInterface {
 
     public void testWithIdNone() throws Exception
     {
-        final ObjectMapper mapper = newObjectMapper();
-        mapper.enableDefaultTyping();
+        final ObjectMapper mapper = jsonMapperBuilder()
+            .enableDefaultTyping(NoCheckSubTypeValidator.instance)
+            .build();
         // serialize without type info
         String json = mapper.writeValueAsString(new NoType());
         assertEquals("{\"a\":3}", json);

diff --git a/src/test/java/com/fasterxml/jackson/databind/jsontype/PolymorphicViaRefTypeTest.java b/src/test/java/com/fasterxml/jackson/databind/jsontype/PolymorphicViaRefTypeTest.java
@@ -7,6 +7,7 @@
 
 import com.fasterxml.jackson.databind.*;
 import com.fasterxml.jackson.databind.ObjectMapper.DefaultTyping;
+import com.fasterxml.jackson.databind.testutil.NoCheckSubTypeValidator;
 
 public class PolymorphicViaRefTypeTest extends BaseMapTest
 {
@@ -61,8 +62,10 @@ public void testPolymorphicAtomicRefProperty() throws Exception
 
     public void testAtomicRefViaDefaultTyping() throws Exception
     {
-        ObjectMapper mapper = new ObjectMapper();
-        mapper.enableDefaultTyping(DefaultTyping.NON_FINAL);
+        ObjectMapper mapper = jsonMapperBuilder()
+                .enableDefaultTyping(NoCheckSubTypeValidator.instance,
+                        DefaultTyping.NON_FINAL)
+                .build();
         AtomicStringWrapper data = new AtomicStringWrapper("foo");
         String json = mapper.writerWithDefaultPrettyPrinter().writeValueAsString(data);
         AtomicStringWrapper result = mapper.readValue(json, AtomicStringWrapper.class);

diff --git a/src/test/java/com/fasterxml/jackson/databind/jsontype/TestAbstractTypeNames.java b/src/test/java/com/fasterxml/jackson/databind/jsontype/TestAbstractTypeNames.java
@@ -9,6 +9,7 @@
 
 import com.fasterxml.jackson.databind.*;
 import com.fasterxml.jackson.databind.ObjectMapper.DefaultTyping;
+import com.fasterxml.jackson.databind.testutil.NoCheckSubTypeValidator;
 
 /**
  * Unit tests for checking how combination of interfaces, implementation
@@ -126,8 +127,10 @@ public void testEmptyCollection() throws Exception
     // [JACKSON-584]: change anonymous non-static inner type into static type:
     public void testInnerClassWithType() throws Exception
     {
-        ObjectMapper mapper = new ObjectMapper();
-        mapper.enableDefaultTyping(DefaultTyping.NON_FINAL);
+        ObjectMapper mapper = jsonMapperBuilder()
+                .enableDefaultTyping(NoCheckSubTypeValidator.instance,
+                        DefaultTyping.NON_FINAL)
+                .build();
         String json = mapper.writeValueAsString(new BeanWithAnon());
         BeanWithAnon result = mapper.readValue(json, BeanWithAnon.class);
         assertEquals(BeanWithAnon.class, result.getClass());

diff --git a/src/test/java/com/fasterxml/jackson/databind/jsontype/TestSubtypes.java b/src/test/java/com/fasterxml/jackson/databind/jsontype/TestSubtypes.java
@@ -1,6 +1,5 @@
 package com.fasterxml.jackson.databind.jsontype;
 
-
 import com.fasterxml.jackson.core.Version;
 
 import java.util.*;
@@ -15,6 +14,7 @@
 import com.fasterxml.jackson.databind.exc.InvalidTypeIdException;
 import com.fasterxml.jackson.databind.jsontype.NamedType;
 import com.fasterxml.jackson.databind.module.SimpleModule;
+import com.fasterxml.jackson.databind.testutil.NoCheckSubTypeValidator;
 
 public class TestSubtypes extends com.fasterxml.jackson.databind.BaseMapTest
 {
@@ -263,7 +263,8 @@ public void testEmptyBean() throws Exception
 
         // and then with defaults
         mapper = new ObjectMapper();
-        mapper.enableDefaultTyping(ObjectMapper.DefaultTyping.NON_FINAL);
+        mapper.enableDefaultTyping(NoCheckSubTypeValidator.instance,
+                ObjectMapper.DefaultTyping.NON_FINAL);
         mapper.configure(SerializationFeature.FAIL_ON_EMPTY_BEANS, false);
         json = mapper.writeValueAsString(new EmptyNonFinal());
         assertEquals("[\"com.fasterxml.jackson.databind.jsontype.TestSubtypes$EmptyNonFinal\",{}]", json);

diff --git a/src/test/java/com/fasterxml/jackson/databind/jsontype/TestWithGenerics.java b/src/test/java/com/fasterxml/jackson/databind/jsontype/TestWithGenerics.java
@@ -11,6 +11,7 @@
 import com.fasterxml.jackson.databind.*;
 import com.fasterxml.jackson.databind.ser.BeanSerializerFactory;
 import com.fasterxml.jackson.databind.ser.ResolvableSerializer;
+import com.fasterxml.jackson.databind.testutil.NoCheckSubTypeValidator;
 
 public class TestWithGenerics extends BaseMapTest
 {
@@ -166,7 +167,8 @@ public void testWrapperWithExplicitType() throws Exception
     public void testJackson387() throws Exception
     {
         ObjectMapper om = new ObjectMapper();
-        om.enableDefaultTyping( ObjectMapper.DefaultTyping.JAVA_LANG_OBJECT, JsonTypeInfo.As.PROPERTY );
+        om.enableDefaultTyping(NoCheckSubTypeValidator.instance,
+                ObjectMapper.DefaultTyping.JAVA_LANG_OBJECT, JsonTypeInfo.As.PROPERTY );
         om.setSerializationInclusion(JsonInclude.Include.NON_NULL );
         om.enable( SerializationFeature.INDENT_OUTPUT);
 

diff --git a/src/test/java/com/fasterxml/jackson/databind/jsontype/TypeRefinementForMapTest.java b/src/test/java/com/fasterxml/jackson/databind/jsontype/TypeRefinementForMapTest.java
@@ -9,6 +9,7 @@
 import com.fasterxml.jackson.databind.*;
 import com.fasterxml.jackson.databind.annotation.JsonDeserialize;
 import com.fasterxml.jackson.databind.annotation.JsonSerialize;
+import com.fasterxml.jackson.databind.testutil.NoCheckSubTypeValidator;
 
 public class TypeRefinementForMapTest extends BaseMapTest
 {
@@ -120,7 +121,10 @@ public void testMapKeyRefinement1384() throws Exception
     {
         final String TEST_INSTANCE_SERIALIZED =
                 "{\"mapProperty\":[\"java.util.HashMap\",{\"Compound|Key\":\"Value\"}]}";
-        ObjectMapper mapper = new ObjectMapper().enableDefaultTyping(ObjectMapper.DefaultTyping.NON_FINAL);
+        ObjectMapper mapper = jsonMapperBuilder()
+                .enableDefaultTyping(NoCheckSubTypeValidator.instance,
+                        ObjectMapper.DefaultTyping.NON_FINAL)
+                .build();
 
         TestClass testInstance = mapper.readValue(TEST_INSTANCE_SERIALIZED, TestClass.class);
         assertEquals(1, testInstance.mapProperty.size());