GumpacG opened a new pull request, #3586:
URL: https://github.com/apache/tinkerpop/pull/3586
## Summary
GraphSON 1.0 with embedded types (`TypeInfo.PARTIAL_TYPES`) configured
Jackson default typing with `JsonTypeInfo.Id.CLASS` and no
`PolymorphicTypeValidator`. Reading a document reconstructed whatever class was
named in its `@class` property, so a crafted document could name and construct
any class on the classpath. It is reachable pre-auth via the typed GraphSON 1.0
wire serializer `GraphSONMessageSerializerV1`
(`application/vnd.gremlin-v1.0+json`), as well as through `io()` reads and
GraphSON 1.0 persistence.
This change constrains that default typing while leaving legitimate value
types working.
## What changed
**New API**
* `GraphSONMapper.Builder.addAllowedTypeIdPrefix(String...)` trusts
additional class-name prefixes for GraphSON 1.0
embedded-type deserialization, in addition to the safe defaults. Intended
for provider/application types read from
trusted input.
**Hardened**
* GraphSON 1.0 `PARTIAL_TYPES` default typing now uses a custom
`PolymorphicTypeValidator` that decides from the
type-id **name**, so a disallowed class is refused in
`validateSubClassName` **before** it is loaded (its static
initializer never runs). The allow-list permits `java.lang`, `java.util`,
`java.math`, `java.time`, `java.sql`,
`org.apache.tinkerpop` and array types (an array is allowed only when its
component type is allowed).
## Behavior change
A GraphSON 1.0 typed document whose `@class` names a type outside the
allowed set now fails on read:
```
org.apache.tinkerpop.shaded.jackson.databind.exc.InvalidTypeIdException:
Could not resolve subtype ...: Configured `PolymorphicTypeValidator` ...
denied resolution
```
## Breaking changes and capability impact
**Breaking:** reading a GraphSON 1.0 typed document that embeds a class
outside the allow-list, for example a
provider type registered through an `IoRegistry`, an application POJO, or a
`java.net.*` value, now fails instead of
being deserialized. This also means a GraphSON 1.0 typed document written by
an older version that embeds such a type
may no longer be readable.
Restore a specific type for trusted input by trusting its package:
```java
GraphSONMapper.build().version(GraphSONVersion.V1_0).typeInfo(TypeInfo.PARTIAL_TYPES)
.addAllowedTypeIdPrefix("com.example.").create();
```
or migrate to GraphSON 3.0 / GraphBinary. Standard scalar, collection, array
and `java.sql`/`java.time` values, and
TinkerPop graph types, are unaffected. The restriction gates reads; the
write path still emits `@class` for any
type, so a writer and reader should be configured consistently.
Assisted-by: Kiro: Claude Opus 4.8
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
