#jackson

Jackson-databind and Default Typing Vulnerabilities

Today, GitHub sent out security notices to owners of projects using old jackson-databind versions (older than 2.8.11.1 and 2.9.5). These notices pertain to this issue. I have talked about its relevance before on IRC, but since it is getting more attention now, I will describe it here again. The Problem The “bug” comes from using the so-called default typing. This feature allows a user to deserialize subclasses (or...

Oct 16, 2018 — 5 minute(s) read

#jackson #json #security #serialization #xml

Immutability in Java

Recently in ##java, we had a discussion on what constitutes “immutability” and how to implement it in java properly. Immutability is a core concept for functional programming, and as mainstream languages and ecosystems “catch up” with the safer, less error-prone ideas from functional programming, immutability is wanted in Java projects as well. What is immutability? Asking programmers for their definition of immutability, you will usually receive an answer such as this: An object is...

Apr 19, 2017 — 9 minute(s) read

#guava #immutability #jackson #jcip #jmm #lombok