{"action":"closed","issue":{"url":"https://api.github.com/repos/FasterXML/jackson3-dev/issues/21","repository_url":"https://api.github.com/repos/FasterXML/jackson3-dev","labels_url":"https://api.github.com/repos/FasterXML/jackson3-dev/issues/21/labels{/name}","comments_url":"https://api.github.com/repos/FasterXML/jackson3-dev/issues/21/comments","events_url":"https://api.github.com/repos/FasterXML/jackson3-dev/issues/21/events","html_url":"https://github.com/FasterXML/jackson3-dev/issues/21","id":283971826,"node_id":"MDU6SXNzdWUyODM5NzE4MjY=","number":21,"title":"Add abstraction for `ClassNameValidator`, for default typing, `@JsonTypeInfo`","user":{"login":"cowtowncoder","id":55065,"node_id":"MDQ6VXNlcjU1MDY1","avatar_url":"https://avatars0.githubusercontent.com/u/55065?v=4","gravatar_id":"","url":"https://api.github.com/users/cowtowncoder","html_url":"https://github.com/cowtowncoder","followers_url":"https://api.github.com/users/cowtowncoder/followers","following_url":"https://api.github.com/users/cowtowncoder/following{/other_user}","gists_url":"https://api.github.com/users/cowtowncoder/gists{/gist_id}","starred_url":"https://api.github.com/users/cowtowncoder/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/cowtowncoder/subscriptions","organizations_url":"https://api.github.com/users/cowtowncoder/orgs","repos_url":"https://api.github.com/users/cowtowncoder/repos","events_url":"https://api.github.com/users/cowtowncoder/events{/privacy}","received_events_url":"https://api.github.com/users/cowtowncoder/received_events","type":"User","site_admin":false},"labels":[{"id":672427297,"node_id":"MDU6TGFiZWw2NzI0MjcyOTc=","url":"https://api.github.com/repos/FasterXML/jackson3-dev/labels/enhancement","name":"enhancement","color":"84b6eb","default":true}],"state":"closed","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":3,"created_at":"2017-12-21T18:50:00Z","updated_at":"2018-12-06T06:53:45Z","closed_at":"2018-12-06T06:53:45Z","author_association":"MEMBER","body":"Due to multiple CVEs for possible exploits via \"default typing\" (or, `@JsonTypeInfo` with base type of `java.lang.Object`) AND a small set of common \"serialization gadgets\", we have added blacklist of such gadgets. Blacklist is a moving target, with steady trickle of new types, and fundamentally can never be 100% complete.\r\n\r\nInclusion of black list is then problematic in a few ways:\r\n\r\n1. As protection it is unlikely to ever be complete for everybody, everywhere\r\n2. Since it's part of `jackson-databind` (for now at least), update requires new release, update by app/service developers\r\n3. Although there are ways around (2) (by subclassing), those are cumbersome and not well known\r\n\r\nAs to (3), it is worth noting that use of:\r\n\r\n* `BeanDeserializerFactory` (used by databind itself for applying blacklist)\r\n* Custom `Module` (before `DeserializerFactory` is invoked)\r\n* `com.fasterxml.jackson.databind.jsontype.impl.ClassNameIdResolver`, even before deserializer, when resolving polymorphic type id as a class\r\n\r\ncan all be used; but are either not module (sub-classing of deserializer factory), or otherwise cumbersome (module, type id resolver).\r\n\r\nBut it should be possible to take another approach: define a new small handler API, to be invoked when:\r\n\r\n1. Resolving subtype to serialize / deserialize\r\n2. Attempting to construct serializer / deserializer\r\n\r\nThis would allow many things, like:\r\n\r\n* Preventing deserialization and/or serialization of types deemed unsafe (or undesired?)\r\n* Changing of type on deserialization (or, for purpose of locating serializer, also serialization?)\r\n\r\none use of which is security check.\r\n\r\nCallback(s) could then:\r\n\r\n* translate type as-is, for \"that's fine\"\r\n* substitute type (subtype for deserialization; supertype for serialization)\r\n* throw exception to indicate that type is illegal to serialize/deserialize\r\n\r\nIn theory it might even be possible to perhaps allow some special handling like \"always deserialize as null\"; but at this point this is speculation.\r\n\r\nAfter defining such handler interface, it should be applied in two ways:\r\n\r\n1. For default typing, REQUIRE passing of such validator. While default implementation (\"just block known serialiation gadgets\") should be available, it SHOULD NOT be passed implicitly. Caller must pass it, to document their choice.\r\n2. For `@JsonTypeInfo` approach, a new property, with default choice, should suffice. Here defaulting should be ok since exploit only applies to case of `java.lang.Object` (and perhaps `java.io.Serializable`, `java.util.Comparable`?)\r\n    * possibly require non-default choice for `java.lang.Object` et al?\r\n\r\nand then polymorphic handler would need to be passed validator to use.\r\n\r\nNet effect of this would be to allow finer-grained control of blocking certain types from polymorphic handling (esp. deserialization).\r\n"}}
{"actor":{"display_login":"cowtowncoder"}}