4 ms·
>it is apparently on by default Curious as to what makes you think this - I was under the impression you needed to explicitly call `enableDefaultTyping` to get
by lol768 7y ago
>it is apparently on by default
Curious as to what makes you think this - I was under the impression you needed to explicitly call `enableDefaultTyping` to get this unsafe behaviour. The wiki page explicitly tells you not to do this with untrusted input and the method is deprecated in the latest versions of the library.
https://github.com/FasterXML/jackson-databind/issues/2195 https://github.com/FasterXML/jackson-databind/issues/2195
https://github.com/FasterXML/jackson-docs/wiki/JacksonPolymorphicDeserialization https://github.com/FasterXML/jackson-docs/wiki/JacksonPolymo...
- vesinisa 7y agoFrom the blog I linked. They might have meant the feature was on by default in 2013. I edited that part away. Here is a much better blog by the library author themself: https://medium.com/@cowtowncoder/on-jackson-cves-dont-panic-here-is-what-you-need-to-know-54cd0d6e8062 https://medium.com/@cowtowncoder/on-jackson-cves-dont-panic-...