java-defects4j-jacksondatabind-94-subtypevalidator

A painting is a person's account of this edit as text, recorded independently of the node mapping - a rendering often has several equally defensible answers where the mapping has one. Deletions and insertions carry no position on the opposite side in a painting, so that panel draws no caret for them.

Before…lines 1–15 unchanged (15 lines)
*
* @since 2.8.11
*/
19public class SubTypeValidator
20{
  protected final static String PREFIX_SPRING = "org.springframework.";
22
23
  /**
   * Set of well-known "nasty classes", deserialization of which is considered dangerous
   * and should (and is) prevented by default.
   */
  protected final static Set<String> DEFAULT_NO_DESER_CLASS_NAMES;
…lines 29–91 unchanged (63 lines)
                  // looking for "AbstractBeanFactoryPointcutAdvisor" but no point to allow any is there?
                  if ("AbstractPointcutAdvisor".equals(name)
                          // ditto  for "FileSystemXmlApplicationContext": block all ApplicationContexts
                          || "AbstractApplicationContext".equals(name)) {
                      break main_check;
                  }
              // [databind#1737]; more 3rd party
              // s.add("com.mchange.v2.c3p0.JndiRefForwardingDataSource");
              // s.add("com.mchange.v2.c3p0.WrapperConnectionPoolDataSource");
              // [databind#1931]; more 3rd party
              // com.mchange.v2.c3p0.ComboPooledDataSource
              // com.mchange.v2.c3p0.debug.AfterCloseLoggingComboPooledDataSource 
              }
          }
          return;
      } while (false);
108
      throw JsonMappingException.from(ctxt,
              String.format("Illegal type (%s) to deserialize: prevented for security reasons", full));
  }
112}
113

After…lines 1–16 unchanged (16 lines)
* @since 2.8.11
*/
19public class SubTypeValidator
20{
  protected final static String PREFIX_SPRING = "org.springframework.";
22
  protected final static String PREFIX_C3P0 = "com.mchange.v2.c3p0.";
24
  /**
   * Set of well-known "nasty classes", deserialization of which is considered dangerous
   * and should (and is) prevented by default.
   */
  protected final static Set<String> DEFAULT_NO_DESER_CLASS_NAMES;
…lines 30–92 unchanged (63 lines)
                  // looking for "AbstractBeanFactoryPointcutAdvisor" but no point to allow any is there?
                  if ("AbstractPointcutAdvisor".equals(name)
                          // ditto  for "FileSystemXmlApplicationContext": block all ApplicationContexts
                          || "AbstractApplicationContext".equals(name)) {
                      break main_check;
                  }
              }
          } else if (full.startsWith(PREFIX_C3P0)) {
              // [databind#1737]; more 3rd party
              // s.add("com.mchange.v2.c3p0.JndiRefForwardingDataSource");
              // s.add("com.mchange.v2.c3p0.WrapperConnectionPoolDataSource");
              // [databind#1931]; more 3rd party
              // com.mchange.v2.c3p0.ComboPooledDataSource
              // com.mchange.v2.c3p0.debug.AfterCloseLoggingComboPooledDataSource 
              if (full.endsWith("DataSource")) {
                  break main_check;
              }
          }
          return;
      } while (false);
113
      throw JsonMappingException.from(ctxt,
              String.format("Illegal type (%s) to deserialize: prevented for security reasons", full));
  }
117}
118

Before…lines 1–15 unchanged (15 lines)
*
* @since 2.8.11
*/
19public class SubTypeValidator
20{
  protected final static String PREFIX_SPRING = "org.springframework.";
22
23
  /**
   * Set of well-known "nasty classes", deserialization of which is considered dangerous
   * and should (and is) prevented by default.
   */
  protected final static Set<String> DEFAULT_NO_DESER_CLASS_NAMES;
…lines 29–91 unchanged (63 lines)
                  // looking for "AbstractBeanFactoryPointcutAdvisor" but no point to allow any is there?
                  if ("AbstractPointcutAdvisor".equals(name)
                          // ditto  for "FileSystemXmlApplicationContext": block all ApplicationContexts
                          || "AbstractApplicationContext".equals(name)) {
                      break main_check;
                  }
              // [databind#1737]; more 3rd party
              // s.add("com.mchange.v2.c3p0.JndiRefForwardingDataSource");
              // s.add("com.mchange.v2.c3p0.WrapperConnectionPoolDataSource");
              // [databind#1931]; more 3rd party
              // com.mchange.v2.c3p0.ComboPooledDataSource
              // com.mchange.v2.c3p0.debug.AfterCloseLoggingComboPooledDataSource 
              }
          }
          return;
      } while (false);
108
      throw JsonMappingException.from(ctxt,
              String.format("Illegal type (%s) to deserialize: prevented for security reasons", full));
  }
112}
113

After…lines 1–16 unchanged (16 lines)
* @since 2.8.11
*/
19public class SubTypeValidator
20{
  protected final static String PREFIX_SPRING = "org.springframework.";
22
  protected final static String PREFIX_C3P0 = "com.mchange.v2.c3p0.";
24
  /**
   * Set of well-known "nasty classes", deserialization of which is considered dangerous
   * and should (and is) prevented by default.
   */
  protected final static Set<String> DEFAULT_NO_DESER_CLASS_NAMES;
…lines 30–92 unchanged (63 lines)
                  // looking for "AbstractBeanFactoryPointcutAdvisor" but no point to allow any is there?
                  if ("AbstractPointcutAdvisor".equals(name)
                          // ditto  for "FileSystemXmlApplicationContext": block all ApplicationContexts
                          || "AbstractApplicationContext".equals(name)) {
                      break main_check;
                  }
              }
          } else if (full.startsWith(PREFIX_C3P0)) {
              // [databind#1737]; more 3rd party
              // s.add("com.mchange.v2.c3p0.JndiRefForwardingDataSource");
              // s.add("com.mchange.v2.c3p0.WrapperConnectionPoolDataSource");
              // [databind#1931]; more 3rd party
              // com.mchange.v2.c3p0.ComboPooledDataSource
              // com.mchange.v2.c3p0.debug.AfterCloseLoggingComboPooledDataSource 
              if (full.endsWith("DataSource")) {
                  break main_check;
              }
          }
          return;
      } while (false);
113
      throw JsonMappingException.from(ctxt,
              String.format("Illegal type (%s) to deserialize: prevented for security reasons", full));
  }
117}
118

Before…lines 1–15 unchanged (15 lines)
*
* @since 2.8.11
*/
19public class SubTypeValidator
20{
  protected final static String PREFIX_SPRING = "org.springframework.";
22
23
  /**
   * Set of well-known "nasty classes", deserialization of which is considered dangerous
   * and should (and is) prevented by default.
   */
  protected final static Set<String> DEFAULT_NO_DESER_CLASS_NAMES;
…lines 29–91 unchanged (63 lines)
                  // looking for "AbstractBeanFactoryPointcutAdvisor" but no point to allow any is there?
                  if ("AbstractPointcutAdvisor".equals(name)
                          // ditto  for "FileSystemXmlApplicationContext": block all ApplicationContexts
                          || "AbstractApplicationContext".equals(name)) {
                      break main_check;
                  }
              // [databind#1737]; more 3rd party
              // s.add("com.mchange.v2.c3p0.JndiRefForwardingDataSource");
              // s.add("com.mchange.v2.c3p0.WrapperConnectionPoolDataSource");
              // [databind#1931]; more 3rd party
              // com.mchange.v2.c3p0.ComboPooledDataSource
              // com.mchange.v2.c3p0.debug.AfterCloseLoggingComboPooledDataSource 
              }
          }
          return;
      } while (false);
108
      throw JsonMappingException.from(ctxt,
              String.format("Illegal type (%s) to deserialize: prevented for security reasons", full));
  }
112}
113

After…lines 1–16 unchanged (16 lines)
* @since 2.8.11
*/
19public class SubTypeValidator
20{
  protected final static String PREFIX_SPRING = "org.springframework.";
22
  protected final static String PREFIX_C3P0 = "com.mchange.v2.c3p0.";
24
  /**
   * Set of well-known "nasty classes", deserialization of which is considered dangerous
   * and should (and is) prevented by default.
   */
  protected final static Set<String> DEFAULT_NO_DESER_CLASS_NAMES;
…lines 30–92 unchanged (63 lines)
                  // looking for "AbstractBeanFactoryPointcutAdvisor" but no point to allow any is there?
                  if ("AbstractPointcutAdvisor".equals(name)
                          // ditto  for "FileSystemXmlApplicationContext": block all ApplicationContexts
                          || "AbstractApplicationContext".equals(name)) {
                      break main_check;
                  }
              }
          } else if (full.startsWith(PREFIX_C3P0)) {
              // [databind#1737]; more 3rd party
              // s.add("com.mchange.v2.c3p0.JndiRefForwardingDataSource");
              // s.add("com.mchange.v2.c3p0.WrapperConnectionPoolDataSource");
              // [databind#1931]; more 3rd party
              // com.mchange.v2.c3p0.ComboPooledDataSource
              // com.mchange.v2.c3p0.debug.AfterCloseLoggingComboPooledDataSource 
              if (full.endsWith("DataSource")) {
                  break main_check;
              }
          }
          return;
      } while (false);
113
      throw JsonMappingException.from(ctxt,
              String.format("Illegal type (%s) to deserialize: prevented for security reasons", full));
  }
117}
118

Before

program

package_declaration

package "package"

scoped_identifier

identifier "com"

. "."

identifier "fasterxml"

. "."

identifier "jackson"

. "."

identifier "databind"

. "."

identifier "jsontype"

. "."

identifier "impl"

; ";"

import_declaration

import "import"

scoped_identifier

identifier "java"

. "."

identifier "util"

. "."

identifier "Collections"

; ";"

import_declaration

import "import"

scoped_identifier

identifier "java"

. "."

identifier "util"

. "."

identifier "HashSet"

; ";"

import_declaration

import "import"

scoped_identifier

identifier "java"

. "."

identifier "util"

. "."

identifier "Set"

; ";"

import_declaration

import "import"

scoped_identifier

identifier "com"

. "."

identifier "fasterxml"

. "."

identifier "jackson"

. "."

identifier "databind"

. "."

identifier "DeserializationContext"

; ";"

import_declaration

import "import"

scoped_identifier

identifier "com"

. "."

identifier "fasterxml"

. "."

identifier "jackson"

. "."

identifier "databind"

. "."

identifier "JavaType"

; ";"

import_declaration

import "import"

scoped_identifier

identifier "com"

. "."

identifier "fasterxml"

. "."

identifier "jackson"

. "."

identifier "databind"

. "."

identifier "JsonMappingException"

; ";"

block_comment "/**\n * Helper class used to encapsulate rules that determine"...

class_declaration

modifiers

public "public"

class "class"

identifier "SubTypeValidator"

class_body

{ "{"

field_declaration

modifiers

protected "protected"

final "final"

static "static"

type_identifier "String"

variable_declarator

identifier "PREFIX_SPRING"

= "="

string_literal

" "\""

string_fragment "org.springframework."

" "\""

; ";"

block_comment "/**\n * Set of well-known \"nasty classes\", deserializatio"...

field_declaration

modifiers

protected "protected"

final "final"

static "static"

generic_type

type_identifier "Set"

type_arguments

< "<"

type_identifier "String"

> ">"

variable_declarator

identifier "DEFAULT_NO_DESER_CLASS_NAMES"

; ";"

static_initializer (+244 nodes collapsed)

block_comment "/**\n * Set of class names of types that are never to be "...

field_declaration

modifiers

protected "protected"

generic_type

type_identifier "Set"

type_arguments

< "<"

type_identifier "String"

> ">"

variable_declarator

identifier "_cfgIllegalClassNames"

= "="

identifier "DEFAULT_NO_DESER_CLASS_NAMES"

; ";"

field_declaration

modifiers

private "private"

final "final"

static "static"

type_identifier "SubTypeValidator"

variable_declarator

identifier "instance"

= "="

object_creation_expression

new "new"

type_identifier "SubTypeValidator"

argument_list

( "("

) ")"

; ";"

constructor_declaration

modifiers

protected "protected"

identifier "SubTypeValidator"

formal_parameters

( "("

) ")"

constructor_body

{ "{"

} "}"

method_declaration

modifiers

public "public"

static "static"

type_identifier "SubTypeValidator"

identifier "instance"

formal_parameters

( "("

) ")"

block

{ "{"

return_statement

return "return"

identifier "instance"

; ";"

} "}"

method_declaration

modifiers

public "public"

void_type "void"

identifier "validateSubType"

formal_parameters

( "("

formal_parameter

type_identifier "DeserializationContext"

identifier "ctxt"

, ","

formal_parameter

type_identifier "JavaType"

identifier "type"

) ")"

throws

throws "throws"

type_identifier "JsonMappingException"

block

{ "{"

line_comment "// There are certain nasty classes that could cause problems"...

line_comment "// via default typing -- catch them here."

local_variable_declaration (+21 nodes collapsed)

local_variable_declaration

type_identifier "String"

variable_declarator

identifier "full"

= "="

method_invocation

identifier "raw"

. "."

identifier "getName"

argument_list

( "("

) ")"

; ";"

labeled_statement

identifier "main_check"

: ":"

do_statement

do "do"

block

{ "{"

if_statement

if "if"

parenthesized_expression

( "("

method_invocation

identifier "_cfgIllegalClassNames"

. "."

identifier "contains"

argument_list

( "("

identifier "full"

) ")"

block

{ "{"

break_statement

break "break"

; ";"

} "}"

line_comment "// 18-Dec-2017, tatu: As per [databind#1855], need bit more "...

line_comment "// for some Spring framework types"

line_comment "// 05-Jan-2017, tatu: ... also, only applies to classes, not"...

if_statement

if "if"

parenthesized_expression

( "("

method_invocation

identifier "raw"

. "."

identifier "isInterface"

argument_list

( "("

) ")"

block

{ "{"

; ";"

} "}"

else "else"

if_statement

if "if"

parenthesized_expression

( "("

method_invocation

identifier "full"

. "."

identifier "startsWith"

argument_list

( "("

identifier "PREFIX_SPRING"

) ")"

block

{ "{"

for_statement

for "for"

( "("

local_variable_declaration

generic_type

type_identifier "Class"

type_arguments

< "<"

wildcard

? "?"

> ">"

variable_declarator

identifier "cls"

= "="

identifier "raw"

; ";"

binary_expression

parenthesized_expression

( "("

binary_expression

identifier "cls"

!= "!="

null_literal "null"

) ")"

&& "&&"

parenthesized_expression

( "("

binary_expression

identifier "cls"

!= "!="

class_literal

type_identifier "Object"

. "."

class "class"

) ")"

; ";"

assignment_expression

identifier "cls"

= "="

method_invocation

identifier "cls"

. "."

identifier "getSuperclass"

argument_list

( "("

) ")"

block

{ "{"

local_variable_declaration

type_identifier "String"

variable_declarator

identifier "name"

= "="

method_invocation

identifier "cls"

. "."

identifier "getSimpleName"

argument_list

( "("

) ")"

; ";"

line_comment "// looking for \"AbstractBeanFactoryPointcutAdvisor\" but no p"...

if_statement (+37 nodes collapsed)

line_comment "// [databind#1737]; more 3rd party"

line_comment "// s.add(\"com.mchange.v2.c3p0.JndiRefForwardingDataSource\");"

line_comment "// s.add(\"com.mchange.v2.c3p0.WrapperConnectionPoolDataSourc"...

line_comment "// [databind#1931]; more 3rd party"

line_comment "// com.mchange.v2.c3p0.ComboPooledDataSource"

line_comment "// com.mchange.v2.c3p0.debug.AfterCloseLoggingComboPooledDat"...

} "}"

return_statement

return "return"

; ";"

} "}"

while "while"

parenthesized_expression

( "("

false "false"

) ")"

; ";"

throw_statement (+25 nodes collapsed)

} "}"

After

program

package_declaration

package "package"

scoped_identifier

identifier "com"

. "."

identifier "fasterxml"

. "."

identifier "jackson"

. "."

identifier "databind"

. "."

identifier "jsontype"

. "."

identifier "impl"

; ";"

import_declaration

import "import"

scoped_identifier

identifier "java"

. "."

identifier "util"

. "."

identifier "Collections"

; ";"

import_declaration

import "import"

scoped_identifier

identifier "java"

. "."

identifier "util"

. "."

identifier "HashSet"

; ";"

import_declaration

import "import"

scoped_identifier

identifier "java"

. "."

identifier "util"

. "."

identifier "Set"

; ";"

import_declaration

import "import"

scoped_identifier

identifier "com"

. "."

identifier "fasterxml"

. "."

identifier "jackson"

. "."

identifier "databind"

. "."

identifier "DeserializationContext"

; ";"

import_declaration

import "import"

scoped_identifier

identifier "com"

. "."

identifier "fasterxml"

. "."

identifier "jackson"

. "."

identifier "databind"

. "."

identifier "JavaType"

; ";"

import_declaration

import "import"

scoped_identifier

identifier "com"

. "."

identifier "fasterxml"

. "."

identifier "jackson"

. "."

identifier "databind"

. "."

identifier "JsonMappingException"

; ";"

block_comment "/**\n * Helper class used to encapsulate rules that determine"...

class_declaration

modifiers

public "public"

class "class"

identifier "SubTypeValidator"

class_body

{ "{"

field_declaration

modifiers

protected "protected"

final "final"

static "static"

type_identifier "String"

variable_declarator

identifier "PREFIX_SPRING"

= "="

string_literal

" "\""

string_fragment "org.springframework."

" "\""

; ";"

field_declaration

modifiers

protected "protected"

final "final"

static "static"

type_identifier "String"

variable_declarator

identifier "PREFIX_C3P0"

= "="

string_literal

" "\""

string_fragment "com.mchange.v2.c3p0."

" "\""

; ";"

block_comment "/**\n * Set of well-known \"nasty classes\", deserializatio"...

field_declaration

modifiers

protected "protected"

final "final"

static "static"

generic_type

type_identifier "Set"

type_arguments

< "<"

type_identifier "String"

> ">"

variable_declarator

identifier "DEFAULT_NO_DESER_CLASS_NAMES"

; ";"

static_initializer (+244 nodes collapsed)

block_comment "/**\n * Set of class names of types that are never to be "...

field_declaration

modifiers

protected "protected"

generic_type

type_identifier "Set"

type_arguments

< "<"

type_identifier "String"

> ">"

variable_declarator

identifier "_cfgIllegalClassNames"

= "="

identifier "DEFAULT_NO_DESER_CLASS_NAMES"

; ";"

field_declaration

modifiers

private "private"

final "final"

static "static"

type_identifier "SubTypeValidator"

variable_declarator

identifier "instance"

= "="

object_creation_expression

new "new"

type_identifier "SubTypeValidator"

argument_list

( "("

) ")"

; ";"

constructor_declaration

modifiers

protected "protected"

identifier "SubTypeValidator"

formal_parameters

( "("

) ")"

constructor_body

{ "{"

} "}"

method_declaration

modifiers

public "public"

static "static"

type_identifier "SubTypeValidator"

identifier "instance"

formal_parameters

( "("

) ")"

block

{ "{"

return_statement

return "return"

identifier "instance"

; ";"

} "}"

method_declaration

modifiers

public "public"

void_type "void"

identifier "validateSubType"

formal_parameters

( "("

formal_parameter

type_identifier "DeserializationContext"

identifier "ctxt"

, ","

formal_parameter

type_identifier "JavaType"

identifier "type"

) ")"

throws

throws "throws"

type_identifier "JsonMappingException"

block

{ "{"

line_comment "// There are certain nasty classes that could cause problems"...

line_comment "// via default typing -- catch them here."

local_variable_declaration (+21 nodes collapsed)

local_variable_declaration

type_identifier "String"

variable_declarator

identifier "full"

= "="

method_invocation

identifier "raw"

. "."

identifier "getName"

argument_list

( "("

) ")"

; ";"

labeled_statement

identifier "main_check"

: ":"

do_statement

do "do"

block

{ "{"

if_statement

if "if"

parenthesized_expression

( "("

method_invocation

identifier "_cfgIllegalClassNames"

. "."

identifier "contains"

argument_list

( "("

identifier "full"

) ")"

block

{ "{"

break_statement

break "break"

; ";"

} "}"

line_comment "// 18-Dec-2017, tatu: As per [databind#1855], need bit more "...

line_comment "// for some Spring framework types"

line_comment "// 05-Jan-2017, tatu: ... also, only applies to classes, not"...

if_statement

if "if"

parenthesized_expression

( "("

method_invocation

identifier "raw"

. "."

identifier "isInterface"

argument_list

( "("

) ")"

block

{ "{"

; ";"

} "}"

else "else"

if_statement

if "if"

parenthesized_expression

( "("

method_invocation

identifier "full"

. "."

identifier "startsWith"

argument_list

( "("

identifier "PREFIX_SPRING"

) ")"

block

{ "{"

for_statement

for "for"

( "("

local_variable_declaration

generic_type

type_identifier "Class"

type_arguments

< "<"

wildcard

? "?"

> ">"

variable_declarator

identifier "cls"

= "="

identifier "raw"

; ";"

binary_expression

parenthesized_expression

( "("

binary_expression

identifier "cls"

!= "!="

null_literal "null"

) ")"

&& "&&"

parenthesized_expression

( "("

binary_expression

identifier "cls"

!= "!="

class_literal

type_identifier "Object"

. "."

class "class"

) ")"

; ";"

assignment_expression

identifier "cls"

= "="

method_invocation

identifier "cls"

. "."

identifier "getSuperclass"

argument_list

( "("

) ")"

block

{ "{"

local_variable_declaration

type_identifier "String"

variable_declarator

identifier "name"

= "="

method_invocation

identifier "cls"

. "."

identifier "getSimpleName"

argument_list

( "("

) ")"

; ";"

line_comment "// looking for \"AbstractBeanFactoryPointcutAdvisor\" but no p"...

if_statement (+37 nodes collapsed)

} "}"

else "else"

if_statement

if "if"

parenthesized_expression

( "("

method_invocation

identifier "full"

. "."

identifier "startsWith"

argument_list

( "("

identifier "PREFIX_C3P0"

) ")"

block

{ "{"

line_comment "// [databind#1737]; more 3rd party"

line_comment "// s.add(\"com.mchange.v2.c3p0.JndiRefForwardingDataSource\");"

line_comment "// s.add(\"com.mchange.v2.c3p0.WrapperConnectionPoolDataSourc"...

line_comment "// [databind#1931]; more 3rd party"

line_comment "// com.mchange.v2.c3p0.ComboPooledDataSource"

line_comment "// com.mchange.v2.c3p0.debug.AfterCloseLoggingComboPooledDat"...

if_statement

if "if"

parenthesized_expression

( "("

method_invocation

identifier "full"

. "."

identifier "endsWith"

argument_list

( "("

string_literal

" "\""

string_fragment "DataSource"

" "\""

) ")"

block

{ "{"

break_statement

break "break"

identifier "main_check"

; ";"

} "}"

return_statement

return "return"

; ";"

} "}"

while "while"

parenthesized_expression

( "("

false "false"

) ")"

; ";"

throw_statement (+25 nodes collapsed)

} "}"