Fix string-based creators with UNWRAP_SINGLE_VALUE_ARRAYS #3666
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
- it seems that the DoS fix in `BeanDeserializer` incorrectly advanced the parser. I've fixed this, but this is potentially security-sensitive, so please take a careful look if this is right :) - I also changed `FactoryBasedEnumDeserializer` to handle unwrapping of strings properly. I haven't touched the error handling when there is another token, that is handled by the branch with the comment `Could argue we should throw an exception but...`. imo that should throw an exception, can we change that in a minor release? Fixes FasterXML#3655
|
Great detective work @yawkat! Spot on wrt As to throwing exception... if this was before 2.14.0, yes. But as things are I think it needs to go in 2.15. |
cowtowncoder
approved these changes
Nov 15, 2022
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
BeanDeserializerincorrectly advanced the parser. I've fixed this, but this is potentially security-sensitive, so please take a careful look if this is right :)FactoryBasedEnumDeserializerto handle unwrapping of strings properly. I haven't touched the error handling when there is another token, that is handled by the branch with the commentCould argue we should throw an exception but.... imo that should throw an exception, can we change that in a minor release?Fixes #3655