You are viewing a plain text version of this content. The canonical link for it is here.

Posted to commits@curator.apache.org by "pjfanning (via GitHub)" <gi...@apache.org> on 2026/07/23 15:03:42 UTC

[I] Add Jackson PolymorphicTypeValidator [curator]

pjfanning opened a new issue, #1297:
URL: https://github.com/apache/curator/issues/1297

   This Jackson usage is very dangerous. It means that Jackson will load any class that appears in the JSON. There is a disallow list for well-known gadgets but it is highly recommended to a PolymorphicTypeValidator to your ObjectMapper to lock down which classes can be loaded.
   https://github.com/search?q=repo%3Aapache%2Fcurator%20Id.CLASS&type=code
   
   Example
   https://github.com/apache/drill/pull/3057/changes#diff-e55fd14c5d3a9a463736a342682c0f7d3644d1e47ba6700c1fce001a493deda1R69
   
   
   


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: commits-unsubscribe@curator.apache.org.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org