Skip to content

Add customizer for PolymorphicTypeValidator in JsonKeysetCursorStrategy #1347

@stupid58fly

Description

@stupid58fly

JsonKeysetCursorStrategy is used to serealize and deserealize keyset scroll position in the data set. The data set is obtained using spring-data. The key of that data entities could be any object. PolymorphicTypeValidator is used to limit allowed deserealization clases to avoid CVEs. However, user might need to add custom types (like uuid, long, collection, project-specific model classes, etc). This should be possible without creating custom JsonKeysetCursorStrategy to override the default one. This could be done i.e. by accepting some configuration in a default constructor and passing it to initCodecConfigurer(), so that JacksonObjectMapperCustomizer allow custom types.

In my case I was missing support for Long, and had to raise a pull request #1346 and create new bean, class and configuration instead of just creating a small customizer. Despite Long is a widely used as keys in databases and thus support has to be default, it might also be the case for project-specific classes. I have also seen another person added support for UUIDs in a PR, because there was no customization.

Metadata

Metadata

Assignees

No one assigned

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions