Skip to content

Commit b829ab8

Browse files
io7mio7m
committed
Merge branch 'release/0.2.0'
2 parents 95d6bde + 7856232 commit b829ab8

File tree

6 files changed

+263
-7
lines changed

6 files changed

+263
-7
lines changed

‎net.adoptopenjdk.v3.api/pom.xml

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -9,7 +9,7 @@
99
<parent>
1010
<artifactId>net.adoptopenjdk</artifactId>
1111
<groupId>net.adoptopenjdk</groupId>
12-
<version>0.1.0</version>
12+
<version>0.2.0</version>
1313
</parent>
1414

1515
<artifactId>net.adoptopenjdk.v3.api</artifactId>

‎net.adoptopenjdk.v3.tests/pom.xml

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -9,7 +9,7 @@
99
<parent>
1010
<artifactId>net.adoptopenjdk</artifactId>
1111
<groupId>net.adoptopenjdk</groupId>
12-
<version>0.1.0</version>
12+
<version>0.2.0</version>
1313
</parent>
1414

1515
<artifactId>net.adoptopenjdk.v3.tests</artifactId>

‎net.adoptopenjdk.v3.vanilla/pom.xml

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -9,7 +9,7 @@
99
<parent>
1010
<artifactId>net.adoptopenjdk</artifactId>
1111
<groupId>net.adoptopenjdk</groupId>
12-
<version>0.1.0</version>
12+
<version>0.2.0</version>
1313
</parent>
1414

1515
<artifactId>net.adoptopenjdk.v3.vanilla</artifactId>

‎net.adoptopenjdk.v3.vanilla/src/main/java/net/adoptopenjdk/v3/vanilla/AOV3Deserializers.java

Lines changed: 248 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,248 @@
1+
/*
2+
* Copyright © 2020 Mark Raynsford <[email protected]> http://io7m.com
3+
*
4+
* Permission to use, copy, modify, and/or distribute this software for any
5+
* purpose with or without fee is hereby granted, provided that the above
6+
* copyright notice and this permission notice appear in all copies.
7+
*
8+
* THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
9+
* WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
10+
* MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY
11+
* SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
12+
* WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
13+
* ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR
14+
* IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
15+
*/
16+
17+
package net.adoptopenjdk.v3.vanilla;
18+
19+
import com.fasterxml.jackson.core.JsonParseException;
20+
import com.fasterxml.jackson.databind.BeanDescription;
21+
import com.fasterxml.jackson.databind.DeserializationConfig;
22+
import com.fasterxml.jackson.databind.JavaType;
23+
import com.fasterxml.jackson.databind.JsonDeserializer;
24+
import com.fasterxml.jackson.databind.JsonMappingException;
25+
import com.fasterxml.jackson.databind.JsonNode;
26+
import com.fasterxml.jackson.databind.KeyDeserializer;
27+
import com.fasterxml.jackson.databind.jsontype.TypeDeserializer;
28+
import com.fasterxml.jackson.databind.module.SimpleDeserializers;
29+
import com.fasterxml.jackson.databind.type.ArrayType;
30+
import com.fasterxml.jackson.databind.type.CollectionLikeType;
31+
import com.fasterxml.jackson.databind.type.CollectionType;
32+
import com.fasterxml.jackson.databind.type.MapLikeType;
33+
import com.fasterxml.jackson.databind.type.MapType;
34+
import com.fasterxml.jackson.databind.type.ReferenceType;
35+
import org.slf4j.Logger;
36+
import org.slf4j.LoggerFactory;
37+
38+
import java.util.Objects;
39+
import java.util.Set;
40+
41+
/**
42+
* A deserializer that only allows for deserializing a fixed set of classes,
43+
* for reasons of security.
44+
*/
45+
46+
final class AOV3Deserializers extends SimpleDeserializers
47+
{
48+
private static final Logger LOG =
49+
LoggerFactory.getLogger(AOV3Deserializers.class);
50+
51+
private final Set<String> whitelist;
52+
53+
private AOV3Deserializers(
54+
final Set<String> inWhitelist)
55+
{
56+
this.whitelist =
57+
Objects.requireNonNull(inWhitelist, "whitelist");
58+
}
59+
60+
private static Set<String> classWhitelist()
61+
{
62+
return Set.of(
63+
"java.lang.String",
64+
"java.math.BigInteger",
65+
"java.net.URI",
66+
"java.util.List<java.lang.String>",
67+
"java.util.List<java.math.BigInteger>",
68+
"java.util.List<net.adoptopenjdk.v3.vanilla.AOV3AST$AOV3BinaryJSON>",
69+
"java.util.List<net.adoptopenjdk.v3.vanilla.AOV3AST$AOV3ListBinaryAssetViewJSON>",
70+
"java.util.List<net.adoptopenjdk.v3.vanilla.AOV3AST$AOV3ReleaseJSON>",
71+
"java.util.List<net.adoptopenjdk.v3.vanilla.AOV3AST$AOV3ReleaseVersionJSON>",
72+
"net.adoptopenjdk.v3.vanilla.AOV3AST.AOV3AvailableReleasesJSON",
73+
"net.adoptopenjdk.v3.vanilla.AOV3AST.AOV3BinaryJSON",
74+
"net.adoptopenjdk.v3.vanilla.AOV3AST.AOV3InstallerJSON",
75+
"net.adoptopenjdk.v3.vanilla.AOV3AST.AOV3ListBinaryAssetViewJSON",
76+
"net.adoptopenjdk.v3.vanilla.AOV3AST.AOV3PackageJSON",
77+
"net.adoptopenjdk.v3.vanilla.AOV3AST.AOV3ReleaseJSON",
78+
"net.adoptopenjdk.v3.vanilla.AOV3AST.AOV3ReleaseNamesJSON",
79+
"net.adoptopenjdk.v3.vanilla.AOV3AST.AOV3ReleaseVersionJSON",
80+
"net.adoptopenjdk.v3.vanilla.AOV3AST.AOV3ReleaseVersionsJSON",
81+
"net.adoptopenjdk.v3.vanilla.AOV3AST.AOV3SourceJSON"
82+
);
83+
}
84+
85+
public static AOV3Deserializers create()
86+
{
87+
final Set<String> whiteList = classWhitelist();
88+
for (final var entry : whiteList) {
89+
LOG.trace("whitelist: {}", entry);
90+
}
91+
return new AOV3Deserializers(whiteList);
92+
}
93+
94+
@Override
95+
public JsonDeserializer<?> findArrayDeserializer(
96+
final ArrayType type,
97+
final DeserializationConfig config,
98+
final BeanDescription beanDesc,
99+
final TypeDeserializer elementTypeDeserializer,
100+
final JsonDeserializer<?> elementDeserializer)
101+
throws JsonMappingException
102+
{
103+
this.checkWhitelist(type.toCanonical());
104+
return super.findArrayDeserializer(
105+
type,
106+
config,
107+
beanDesc,
108+
elementTypeDeserializer,
109+
elementDeserializer);
110+
}
111+
112+
private void checkWhitelist(final String name)
113+
{
114+
LOG.trace("checkWhitelist: {}", name);
115+
116+
if (!this.whitelist.contains(name)) {
117+
throw new IllegalArgumentException(
118+
String.format("Deserializing a value of type %s is not allowed", name));
119+
}
120+
}
121+
122+
@Override
123+
public JsonDeserializer<?> findBeanDeserializer(
124+
final JavaType type,
125+
final DeserializationConfig config,
126+
final BeanDescription beanDesc)
127+
throws JsonMappingException
128+
{
129+
this.checkWhitelist(type.getRawClass().getCanonicalName());
130+
return super.findBeanDeserializer(type, config, beanDesc);
131+
}
132+
133+
@Override
134+
public JsonDeserializer<?> findCollectionDeserializer(
135+
final CollectionType type,
136+
final DeserializationConfig config,
137+
final BeanDescription beanDesc,
138+
final TypeDeserializer elementTypeDeserializer,
139+
final JsonDeserializer<?> elementDeserializer)
140+
throws JsonMappingException
141+
{
142+
this.checkWhitelist(type.toCanonical());
143+
return super.findCollectionDeserializer(
144+
type,
145+
config,
146+
beanDesc,
147+
elementTypeDeserializer,
148+
elementDeserializer);
149+
}
150+
151+
@Override
152+
public JsonDeserializer<?> findCollectionLikeDeserializer(
153+
final CollectionLikeType type,
154+
final DeserializationConfig config,
155+
final BeanDescription beanDesc,
156+
final TypeDeserializer elementTypeDeserializer,
157+
final JsonDeserializer<?> elementDeserializer)
158+
throws JsonMappingException
159+
{
160+
this.checkWhitelist(type.toCanonical());
161+
return super.findCollectionLikeDeserializer(
162+
type,
163+
config,
164+
beanDesc,
165+
elementTypeDeserializer,
166+
elementDeserializer);
167+
}
168+
169+
@Override
170+
public JsonDeserializer<?> findEnumDeserializer(
171+
final Class<?> type,
172+
final DeserializationConfig config,
173+
final BeanDescription beanDesc)
174+
throws JsonMappingException
175+
{
176+
this.checkWhitelist(type.getCanonicalName());
177+
return super.findEnumDeserializer(type, config, beanDesc);
178+
}
179+
180+
@Override
181+
public JsonDeserializer<?> findTreeNodeDeserializer(
182+
final Class<? extends JsonNode> nodeType,
183+
final DeserializationConfig config,
184+
final BeanDescription beanDesc)
185+
throws JsonMappingException
186+
{
187+
this.checkWhitelist(nodeType.getCanonicalName());
188+
return super.findTreeNodeDeserializer(nodeType, config, beanDesc);
189+
}
190+
191+
@Override
192+
public JsonDeserializer<?> findReferenceDeserializer(
193+
final ReferenceType refType,
194+
final DeserializationConfig config,
195+
final BeanDescription beanDesc,
196+
final TypeDeserializer contentTypeDeserializer,
197+
final JsonDeserializer<?> contentDeserializer)
198+
throws JsonMappingException
199+
{
200+
this.checkWhitelist(refType.toCanonical());
201+
return super.findReferenceDeserializer(
202+
refType,
203+
config,
204+
beanDesc,
205+
contentTypeDeserializer,
206+
contentDeserializer);
207+
}
208+
209+
@Override
210+
public JsonDeserializer<?> findMapDeserializer(
211+
final MapType type,
212+
final DeserializationConfig config,
213+
final BeanDescription beanDesc,
214+
final KeyDeserializer keyDeserializer,
215+
final TypeDeserializer elementTypeDeserializer,
216+
final JsonDeserializer<?> elementDeserializer)
217+
throws JsonMappingException
218+
{
219+
this.checkWhitelist(type.toCanonical());
220+
return super.findMapDeserializer(
221+
type,
222+
config,
223+
beanDesc,
224+
keyDeserializer,
225+
elementTypeDeserializer,
226+
elementDeserializer);
227+
}
228+
229+
@Override
230+
public JsonDeserializer<?> findMapLikeDeserializer(
231+
final MapLikeType type,
232+
final DeserializationConfig config,
233+
final BeanDescription beanDesc,
234+
final KeyDeserializer keyDeserializer,
235+
final TypeDeserializer elementTypeDeserializer,
236+
final JsonDeserializer<?> elementDeserializer)
237+
throws JsonMappingException
238+
{
239+
this.checkWhitelist(type.toCanonical());
240+
return super.findMapLikeDeserializer(
241+
type,
242+
config,
243+
beanDesc,
244+
keyDeserializer,
245+
elementTypeDeserializer,
246+
elementDeserializer);
247+
}
248+
}

‎net.adoptopenjdk.v3.vanilla/src/main/java/net/adoptopenjdk/v3/vanilla/AOV3ObjectMappers.java

Lines changed: 11 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -17,6 +17,7 @@
1717
import com.fasterxml.jackson.databind.DeserializationFeature;
1818
import com.fasterxml.jackson.databind.ObjectMapper;
1919
import com.fasterxml.jackson.databind.json.JsonMapper;
20+
import com.fasterxml.jackson.databind.module.SimpleModule;
2021

2122
public final class AOV3ObjectMappers
2223
{
@@ -27,8 +28,15 @@ private AOV3ObjectMappers()
2728

2829
public static ObjectMapper createObjectMapper()
2930
{
30-
return JsonMapper.builder()
31-
.configure(DeserializationFeature.USE_BIG_INTEGER_FOR_INTS, true)
32-
.build();
31+
final JsonMapper mapper =
32+
JsonMapper.builder()
33+
.configure(DeserializationFeature.USE_BIG_INTEGER_FOR_INTS, true)
34+
.build();
35+
36+
final var deserializers = AOV3Deserializers.create();
37+
final var simpleModule = new SimpleModule();
38+
simpleModule.setDeserializers(deserializers);
39+
mapper.registerModule(simpleModule);
40+
return mapper;
3341
}
3442
}

‎pom.xml

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -14,7 +14,7 @@
1414

1515
<groupId>net.adoptopenjdk</groupId>
1616
<artifactId>net.adoptopenjdk</artifactId>
17-
<version>0.1.0</version>
17+
<version>0.2.0</version>
1818
<packaging>pom</packaging>
1919

2020
<name>net.adoptopenjdk</name>

0 commit comments

Comments
 (0)