CAMEL-23803: block unsafe polymorphic base types by default in camel-jackson-avro and camel-jackson-protobuf#24195
Conversation
…jackson-avro and camel-jackson-protobuf The camel-jackson-avro and camel-jackson-protobuf data formats now create their default AvroMapper / ProtobufMapper with MapperFeature.BLOCK_UNSAFE_POLYMORPHIC_BASE_TYPES enabled, mirroring the hardening already applied to camel-jackson (CAMEL-23786) and camel-jacksonxml (CAMEL-23787) and to their respective transform/ mappers. This is defense-in-depth against gadget-chain deserialization: when polymorphic / default typing is enabled, Jackson refuses unsafe base types (Object, Serializable, Comparable). Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> Signed-off-by: Andrea Cosentino <ancosen@gmail.com>
gnodet
left a comment
gnodet
left a comment
There was a problem hiding this comment.
Clean, focused security-hardening PR — consistent with the sibling changes in CAMEL-23786 (camel-jackson, #24134 merged) and CAMEL-23787 (camel-jacksonxml, #24177 merged). The transform/Avro.java and transform/Protobuf.java in the same modules already had this flag, so this closes the gap in the data format classes.
Strengths:
- Minimal, surgical change — two
createNewObjectMapper()overrides, two tests, three upgrade-guide entries - Consistent with the pattern established by the sibling PRs
- Opt-out path clearly documented (supply your own mapper via
objectMapperoption) - camel-jackson3 exclusion is sensible and well-explained
- No generated files needed since this is internal to
createNewObjectMapper()— correct
Minor observations (non-blocking):
-
Test robustness: The sibling test in PR #24134 calls
df.setUseDefaultObjectMapper(false)to ensurecreateNewObjectMapper()is exercised rather than a registry-provided mapper. These tests don't. In a cleanDefaultCamelContextit doesn't matter (no mapper in registry), but the sibling's approach is more explicit — consider aligning for consistency. -
JIRA housekeeping: CAMEL-23803 is still in "Open" status (not "In Progress") and
fixVersionsis empty. Per project conventions, transition to "In Progress" before starting work, and setfixVersionsbefore closing.
Overall this looks good to merge.
This review was generated by an AI agent and may contain inaccuracies. Please verify all suggestions before applying.
Claude Code on behalf of Guillaume Nodet
| try (DefaultCamelContext context = new DefaultCamelContext()) { | ||
| context.start(); | ||
| JacksonAvroDataFormat df = new JacksonAvroDataFormat(); | ||
| df.setCamelContext(context); |
There was a problem hiding this comment.
Nit: the sibling test in PR #24134 (camel-jackson) calls df.setUseDefaultObjectMapper(false) before df.start() to guarantee that createNewObjectMapper() is exercised rather than picking up a mapper from the registry. This test relies on the DefaultCamelContext having no ObjectMapper registered, which is true today but fragile. Consider adding df.setUseDefaultObjectMapper(false) for consistency with the sibling.
Claude Code on behalf of Guillaume Nodet
|
🌟 Thank you for your contribution to the Apache Camel project! 🌟 🐫 Apache Camel Committers, please review the following items:
|
|
🧪 CI tested the following changed modules:
All tested modules (13 modules)
|
3 participants
Summary
Follow-up to CAMEL-23786 (camel-jackson) and CAMEL-23787 (camel-jacksonxml), raised in review of #24134.
camel-jackson-avro'sJacksonAvroDataFormat.createNewObjectMapper()andcamel-jackson-protobuf'sJacksonProtobufDataFormat.createNewObjectMapper()returned a barenew AvroMapper()/new ProtobufMapper(), while theirtransform/counterparts (transform/Avro.java,transform/Protobuf.java) already enableMapperFeature.BLOCK_UNSAFE_POLYMORPHIC_BASE_TYPES. This closes that gap so all sibling Jackson data formats are consistent.When polymorphic / default typing is enabled, Jackson now refuses unsafe base types (
Object,Serializable,Comparable) — defense-in-depth against gadget-chain deserialization. Ordinary marshalling/unmarshalling is unchanged.Changes
JacksonAvroDataFormat.createNewObjectMapper()→AvroMapper.builder().enable(BLOCK_UNSAFE_POLYMORPHIC_BASE_TYPES).build().JacksonProtobufDataFormat.createNewObjectMapper()→ProtobufMapper.builder().enable(BLOCK_UNSAFE_POLYMORPHIC_BASE_TYPES).build().JacksonAvroDataFormatPolymorphicHardeningTestandJacksonProtobufDataFormatPolymorphicHardeningTestasserting the feature is enabled on each data format's default mapper.mainper the docs-on-main policy, since this is backported to the 4.18.x and 4.14.x maintenance lines).Opt-out
Routes that deliberately rely on polymorphic/default typing on an unsafe base type can supply their own mapper (via the
objectMapperoption) configured without this feature.Note on camel-jackson3
camel-jackson3(Jackson 3.x) is intentionally excluded: no code enables thisMapperFeature, and Jackson 3 reworked default typing with a mandatoryPolymorphicTypeValidator, so the flag likely does not apply. Left for a dedicated Jackson-3 review.Backport
Will be backported to
camel-4.18.xandcamel-4.14.x(code + test only; upgrade-guide entries stay onmain), keeping the hardening consistent with camel-jackson/camel-jacksonxml on those lines.AI-generated by Claude Code on behalf of Andrea Cosentino.