Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Add java.util.UUID to the trusted classes list in Jackson2ExecutionContextStringSerializer #4110

Closed
junyongz opened this issue May 10, 2022 · 1 comment
Closed

Add java.util.UUID to the trusted classes list in Jackson2ExecutionContextStringSerializer #4110

junyongz opened this issue May 10, 2022 · 1 comment
Labels
for: backport-to-4.3.x Issues that will be back-ported to the 4.3.x line in: core type: enhancement
Milestone
5.0.0-M3

Comments

@junyongz
Copy link

spring-batch/spring-batch-core/src/main/java/org/springframework/batch/core/repository/dao/Jackson2ExecutionContextStringSerializer.java

Line 259 in 5bce152

private static final Set<String> TRUSTED_CLASS_NAMES = Collections.unmodifiableSet(new HashSet<>(Arrays.asList(

Btw, it is quite painful to add the custom serializer into JobRepositoryFactoryBean and JobExplorerFactoryBean.
is there a better way just to make Jackson2ExecutionContextStringSerializeras a @Bean
@fmbenhassine fmbenhassine added in: core type: enhancement for: backport-to-4.3.x Issues that will be back-ported to the 4.3.x line labels May 17, 2022
@fmbenhassine fmbenhassine added this to the 5.0.0-M3 milestone May 17, 2022
@fmbenhassine
Copy link
Contributor

Btw, it is quite painful to add the custom serializer into JobRepositoryFactoryBean and JobExplorerFactoryBean.
is there a better way just to make Jackson2ExecutionContextStringSerializeras a @bean

This will be addressed in #3942 in which we have some options to simplify this. Please upvote the issue or add a comment if you have another suggestion. We are open to any improvement ideas.

fmbenhassine added a commit that referenced this issue May 17, 2022
@fmbenhassine
Add java.util.UUID to trusted classes in Jackson serializer
1199740 
This class is safe to deserialize according to Jackson:
https://github.com/FasterXML/jackson-databind/blob/master/src/main/java/com/fasterxml/jackson/databind/jsontype/impl/SubTypeValidator.java

This also has been checked against Jackson 2.11 to confirm
the backport of this enhancement to 4.3.x.

Resolves #4110
@fmbenhassine fmbenhassine changed the title Consider to add java.util.UUID as recognized class in Jackson2ExecutionContextStringSerializer Add java.util.UUID to the trusted classes list in Jackson2ExecutionContextStringSerializer May 17, 2022
@fmbenhassine fmbenhassine mentioned this issue May 17, 2022
Closed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
for: backport-to-4.3.x Issues that will be back-ported to the 4.3.x line in: core type: enhancement
Projects
None yet
Milestone
5.0.0-M3
Development

No branches or pull requests
2 participants
@junyongz @fmbenhassine