Add Deserializers.hasDeserializerFor()
(and something for DeserializerFactory
) to allow detection of explicitly supported types
#2539
Labels
3.x
Issues to be only tackled for Jackson 3.x, not 2.x
Addition of "Safe Default Typing" in 2.10 is good for security, but can add complexity to actual allow-listing of types considered safe for purposes of polymorphic deserialization.
One thing that could significantly simplify adding rules would be ability to figure out types supported with explicit deserializers, provided by modules (esp. datatype ones). This should indicate all explicitly handled cases, but specifically NOT introspection based "POJO" (and similar for Scala, Kotlin) values.
If support method was added in
Deserializers
(and something forDeserializerFactory
), we could add a mechanism inBasicPolymorphicTypeValidator
to indicate something like "if type is explicitly supported, allow. This would then support things like:java.net.URL
,java.util.UUID
)java.util.Date
/Calendar
)JsonNode
types.and 3rd party types of Joda, Guava, etc.
The text was updated successfully, but these errors were encountered: