PJ Fanning created DRILL-8549:
---------------------------------
Summary: Insecure Jackson deserialization
Key: DRILL-8549
URL: https://issues.apache.org/jira/browse/DRILL-8549
Project: Apache Drill
Issue Type: Task
Reporter: PJ Fanning
https://github.com/apache/drill/blob/09ff1949aac7282dafec0f10ae16669b4f7d8c08/exec/java-exec/src/main/java/org/apache/drill/exec/planner/physical/PartitionFunction.java#L27
`@JsonTypeInfo(use = JsonTypeInfo.Id.CLASS)` – when you deserialize the
`@class` value that appears in the JSON can be any class name and Jackson will
load that class and try to create an instance.
You should add a polymorphic type validator to your ObjectMapper that restricts
which classes can be loaded at deserialization time.
[https://fasterxml.github.io/jackson-databind/javadoc/2.10/com/fasterxml/jackson/databind/jsontype/BasicPolymorphicTypeValidator.html]
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
