-
Notifications
You must be signed in to change notification settings - Fork 82
Closed
Milestone
Description
Let's look at deserializing an integer field, for example.
The code path in afterburner ends up here:
Line 40 in 2486587
int v = p.hasToken(JsonToken.VALUE_NUMBER_INT) ? p.getIntValue() : _deserializeInt(p, ctxt); |
If the value being deserialized is not a VALUE_NUMBER_INT, then the code delegates to _deserializeInt
which will always attempt to coerce a VALUE_STRING to an integer:
Lines 242 to 264 in 2486587
if (t == JsonToken.VALUE_STRING) { // let's do implicit re-parse | |
String text = p.getText().trim(); | |
if (_hasTextualNull(text)) { | |
return 0; | |
} | |
try { | |
int len = text.length(); | |
if (len > 9) { | |
long l = Long.parseLong(text); | |
if (l < Integer.MIN_VALUE || l > Integer.MAX_VALUE) { | |
throw ctxt.weirdStringException(text, Integer.TYPE, | |
"Overflow: numeric value ("+text+") out of range of int ("+Integer.MIN_VALUE+" - "+Integer.MAX_VALUE+")"); | |
} | |
return (int) l; | |
} | |
if (len == 0) { | |
return 0; | |
} | |
return NumberInput.parseInt(text); | |
} catch (IllegalArgumentException iae) { | |
throw ctxt.weirdStringException(text, Integer.TYPE, "not a valid int value"); | |
} | |
} |
This code path should only be enabled if MapperFeature.ALLOW_COERCION_OF_SCALARS is enabled.
Similarly, this check should be performed when attempting to deserialize other scalar types like boolean and long.
Metadata
Metadata
Assignees
Labels
No labels