4 ms·
This is one of the fixes: https://github.com/FasterXML/jackson-databind/commit/9593e16cf5a3d289a9c584f7123639655de9ddac https://github.com/FasterXML/jackson-dat
by orf 7y ago
This is one of the fixes: https://github.com/FasterXML/jackson-databind/commit/9593e16cf5a3d289a9c584f7123639655de9ddac https://github.com/FasterXML/jackson-databind/commit/9593e16...
It seems like it's a blacklist of types to not automatically de-serialize? If so, that's.... not good.
- dtech 7y agoIt's not. Jackson has been aware of that for some time. Initially it was hoped a blacklist would be good enough, but it wasn't. In the latest 2.10 version, the unsafe way is deprecated and an alternative. It must be noted that the vast majority of Jackson use cases is not affected, you need to enable an optional feature that has been known to be unsafe for years [1] [1] https://medium.com/@cowtowncoder/on-jackson-cves-dont-panic-here-is-what-you-need-to-know-54cd0d6e8062 https://medium.com/@cowtowncoder/on-jackson-cves-dont-panic-...