From 398d52a5819e274c0c2d0d15ee265125195cc8bb Mon Sep 17 00:00:00 2001 From: Mahmoud Ben Hassine Date: Tue, 17 May 2022 15:32:21 +0200 Subject: [PATCH] Add javax.xml.namespace.QName to trusted classes in Jackson serializer This class is safe to deserialize according to Jackson: https://github.com/FasterXML/jackson-databind/blob/master/src/main/java/com/fasterxml/jackson/databind/jsontype/impl/SubTypeValidator.java This also has been checked against Jackson 2.11 to confirm the backport of this enhancement to 4.3.x. Resolves #4044 --- .../repository/dao/Jackson2ExecutionContextStringSerializer.java | 1 + 1 file changed, 1 insertion(+) diff --git a/spring-batch-core/src/main/java/org/springframework/batch/core/repository/dao/Jackson2ExecutionContextStringSerializer.java b/spring-batch-core/src/main/java/org/springframework/batch/core/repository/dao/Jackson2ExecutionContextStringSerializer.java index 56e1e2f20..42bc56161 100644 --- a/spring-batch-core/src/main/java/org/springframework/batch/core/repository/dao/Jackson2ExecutionContextStringSerializer.java +++ b/spring-batch-core/src/main/java/org/springframework/batch/core/repository/dao/Jackson2ExecutionContextStringSerializer.java @@ -257,6 +257,7 @@ public class Jackson2ExecutionContextStringSerializer implements ExecutionContex */ static class TrustedTypeIdResolver implements TypeIdResolver { private static final Set TRUSTED_CLASS_NAMES = Collections.unmodifiableSet(new HashSet<>(Arrays.asList( + "javax.xml.namespace.QName", "java.util.UUID", "java.util.ArrayList", "java.util.Arrays$ArrayList",