Skip to content

Commit 398d52a

Browse files
committed
Add javax.xml.namespace.QName to trusted classes in Jackson serializer
This class is safe to deserialize according to Jackson: https://github.com/FasterXML/jackson-databind/blob/master/src/main/java/com/fasterxml/jackson/databind/jsontype/impl/SubTypeValidator.java This also has been checked against Jackson 2.11 to confirm the backport of this enhancement to 4.3.x. Resolves #4044
1 parent c0b8211 commit 398d52a

File tree

1 file changed

+1
-0
lines changed

1 file changed

+1
-0
lines changed

spring-batch-core/src/main/java/org/springframework/batch/core/repository/dao/Jackson2ExecutionContextStringSerializer.java

+1
Original file line numberDiff line numberDiff line change
@@ -257,6 +257,7 @@ protected TypeIdResolver idResolver(MapperConfig<?> config,
257257
*/
258258
static class TrustedTypeIdResolver implements TypeIdResolver {
259259
private static final Set<String> TRUSTED_CLASS_NAMES = Collections.unmodifiableSet(new HashSet<>(Arrays.asList(
260+
"javax.xml.namespace.QName",
260261
"java.util.UUID",
261262
"java.util.ArrayList",
262263
"java.util.Arrays$ArrayList",

0 commit comments

Comments
 (0)