Skip to content

Commit c2a5028

Browse files
committed
Add javax.xml.namespace.QName to trusted classes in Jackson serializer
This class is safe to deserialize according to Jackson: https://github.com/FasterXML/jackson-databind/blob/master/src/main/java/com/fasterxml/jackson/databind/jsontype/impl/SubTypeValidator.java This also has been checked against Jackson 2.11 to confirm the backport of this enhancement to 4.3.x. Resolves #4044
1 parent 1199740 commit c2a5028

File tree

1 file changed

+1
-0
lines changed

1 file changed

+1
-0
lines changed

spring-batch-core/src/main/java/org/springframework/batch/core/repository/dao/Jackson2ExecutionContextStringSerializer.java

+1
Original file line numberDiff line numberDiff line change
@@ -254,6 +254,7 @@ protected TypeIdResolver idResolver(MapperConfig<?> config,
254254
*/
255255
static class TrustedTypeIdResolver implements TypeIdResolver {
256256
private static final Set<String> TRUSTED_CLASS_NAMES = Collections.unmodifiableSet(new HashSet(Arrays.asList(
257+
"javax.xml.namespace.QName",
257258
"java.util.UUID",
258259
"java.util.ArrayList",
259260
"java.util.Arrays$ArrayList",

0 commit comments

Comments
 (0)