You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@pekko.apache.org by fa...@apache.org on 2026/07/10 17:06:15 UTC
(pekko) branch 1.7.x updated: jackson MINIMAL_CLASS setting is dangerous too (#3304) (#3309)
This is an automated email from the ASF dual-hosted git repository.
pjfanning pushed a commit to branch 1.7.x
in repository https://gitbox.apache.org/repos/asf/pekko.git
The following commit(s) were added to refs/heads/1.7.x by this push:
new 5dcdae7824 jackson MINIMAL_CLASS setting is dangerous too (#3304) (#3309)
5dcdae7824 is described below
commit 5dcdae78245955a765c0085d59e10f6a5186ccdc
Author: PJ Fanning <pj...@users.noreply.github.com>
AuthorDate: Fri Jul 10 18:06:09 2026 +0100
jackson MINIMAL_CLASS setting is dangerous too (#3304) (#3309)
---
docs/src/main/paradox/serialization-jackson.md | 8 ++++----
1 file changed, 4 insertions(+), 4 deletions(-)
diff --git a/docs/src/main/paradox/serialization-jackson.md b/docs/src/main/paradox/serialization-jackson.md
index dfd0a7bcad..d6884b3665 100644
--- a/docs/src/main/paradox/serialization-jackson.md
+++ b/docs/src/main/paradox/serialization-jackson.md
@@ -77,8 +77,8 @@ and disallowed for deserialization.
@@@ warning
-Don't use @javadoc[@JsonTypeInfo(use = Id.CLASS)](com.fasterxml.jackson.annotation.JsonTypeInfo) or @javadoc[ObjectMapper.enableDefaultTyping](com.fasterxml.jackson.databind.ObjectMapper#enableDefaultTyping--) since that is a security risk
-when using @ref:[polymorphic types](#polymorphic-types).
+Don't use @javadoc[@JsonTypeInfo(use = Id.CLASS)](com.fasterxml.jackson.annotation.JsonTypeInfo), @javadoc[@JsonTypeInfo(use = Id.MINIMAL_CLASS)](com.fasterxml.jackson.annotation.JsonTypeInfo)
+or @javadoc[ObjectMapper.enableDefaultTyping](com.fasterxml.jackson.databind.ObjectMapper#enableDefaultTyping--) since that is a security risk when using @ref:[polymorphic types](#polymorphic-types).
@@@
@@ -156,8 +156,8 @@ when deserializing.
@@@ warning
-Don't use @javadoc[@JsonTypeInfo(use = Id.CLASS)](com.fasterxml.jackson.annotation.JsonTypeInfo) or @javadoc[ObjectMapper.enableDefaultTyping](com.fasterxml.jackson.databind.ObjectMapper#enableDefaultTyping--) since that is a security risk
-when using polymorphic types.
+Don't use @javadoc[@JsonTypeInfo(use = Id.CLASS)](com.fasterxml.jackson.annotation.JsonTypeInfo), @javadoc[@JsonTypeInfo(use = Id.MINIMAL_CLASS)](com.fasterxml.jackson.annotation.JsonTypeInfo)
+or @javadoc[ObjectMapper.enableDefaultTyping](com.fasterxml.jackson.databind.ObjectMapper#enableDefaultTyping--) since that is a security risk when using @ref:[polymorphic types](#polymorphic-types).
@@@
---------------------------------------------------------------------
To unsubscribe, e-mail: commits-unsubscribe@pekko.apache.org
For additional commands, e-mail: commits-help@pekko.apache.org