Spring/spring-framework
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Prevent kotlinx.serialization usage on collection of interfaces

Browse Source 
Closes gh-26371
This commit is contained in:
Sébastien Deleuze
2021-02-15 14:44:08 +01:00
parent 0fc8bf654b
commit 9c6b1b645d
6 changed files with 67 additions and 12 deletions
Download Patch File Download Diff File Expand all files Collapse all files

21
spring-web/src/main/java/org/springframework/http/codec/json/KotlinSerializationJsonDecoder.java
View File

@@ -1,5 +1,5 @@
/*
* Copyright 2002-2020 the original author or authors.
* Copyright 2002-2021 the original author or authors.
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
@@ -17,11 +17,14 @@
package org.springframework.http.codec.json;
import java.lang.reflect.Type;
import java.util.HashSet;
import java.util.Map;
import java.util.Set;
import kotlinx.serialization.KSerializer;
import kotlinx.serialization.SerializersKt;
import kotlinx.serialization.descriptors.PolymorphicKind;
import kotlinx.serialization.descriptors.SerialDescriptor;
import kotlinx.serialization.json.Json;
import org.reactivestreams.Publisher;
import reactor.core.publisher.Flux;
@@ -135,7 +138,7 @@ public class KotlinSerializationJsonDecoder extends AbstractDecoder<Object> {
KSerializer<Object> serializer = serializerCache.get(type);
if (serializer == null) {
serializer = SerializersKt.serializer(type);
if (serializer.getDescriptor().getKind().equals(PolymorphicKind.OPEN.INSTANCE)) {
if (hasPolymorphism(serializer.getDescriptor(), new HashSet<>())) {
throw new UnsupportedOperationException("Open polymorphic serialization is not supported yet");
}
serializerCache.put(type, serializer);
@@ -143,4 +146,18 @@ public class KotlinSerializationJsonDecoder extends AbstractDecoder<Object> {
return serializer;
}
private boolean hasPolymorphism(SerialDescriptor descriptor, Set<String> alreadyProcessed) {
alreadyProcessed.add(descriptor.getSerialName());
if (descriptor.getKind().equals(PolymorphicKind.OPEN.INSTANCE)) {
return true;
}
for (int i = 0 ; i < descriptor.getElementsCount() ; i++) {
SerialDescriptor elementDescriptor = descriptor.getElementDescriptor(i);
if (!alreadyProcessed.contains(elementDescriptor.getSerialName()) && hasPolymorphism(elementDescriptor, alreadyProcessed)) {
return true;
}
}
return false;
}
}

21
spring-web/src/main/java/org/springframework/http/codec/json/KotlinSerializationJsonEncoder.java
View File

@@ -1,5 +1,5 @@
/*
* Copyright 2002-2020 the original author or authors.
* Copyright 2002-2021 the original author or authors.
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
@@ -17,12 +17,15 @@
package org.springframework.http.codec.json;
import java.lang.reflect.Type;
import java.util.HashSet;
import java.util.List;
import java.util.Map;
import java.util.Set;
import kotlinx.serialization.KSerializer;
import kotlinx.serialization.SerializersKt;
import kotlinx.serialization.descriptors.PolymorphicKind;
import kotlinx.serialization.descriptors.SerialDescriptor;
import kotlinx.serialization.json.Json;
import org.reactivestreams.Publisher;
import reactor.core.publisher.Flux;
@@ -123,7 +126,7 @@ public class KotlinSerializationJsonEncoder extends AbstractEncoder<Object> {
KSerializer<Object> serializer = serializerCache.get(type);
if (serializer == null) {
serializer = SerializersKt.serializer(type);
if (serializer.getDescriptor().getKind().equals(PolymorphicKind.OPEN.INSTANCE)) {
if (hasPolymorphism(serializer.getDescriptor(), new HashSet<>())) {
throw new UnsupportedOperationException("Open polymorphic serialization is not supported yet");
}
serializerCache.put(type, serializer);
@@ -131,4 +134,18 @@ public class KotlinSerializationJsonEncoder extends AbstractEncoder<Object> {
return serializer;
}
private boolean hasPolymorphism(SerialDescriptor descriptor, Set<String> alreadyProcessed) {
alreadyProcessed.add(descriptor.getSerialName());
if (descriptor.getKind().equals(PolymorphicKind.OPEN.INSTANCE)) {
return true;
}
for (int i = 0 ; i < descriptor.getElementsCount() ; i++) {
SerialDescriptor elementDescriptor = descriptor.getElementDescriptor(i);
if (!alreadyProcessed.contains(elementDescriptor.getSerialName()) && hasPolymorphism(elementDescriptor, alreadyProcessed)) {
return true;
}
}
return false;
}
}

19
spring-web/src/main/java/org/springframework/http/converter/json/KotlinSerializationJsonHttpMessageConverter.java
View File

@@ -20,12 +20,15 @@ import java.io.IOException;
import java.lang.reflect.Type;
import java.nio.charset.Charset;
import java.nio.charset.StandardCharsets;
import java.util.HashSet;
import java.util.Map;
import java.util.Set;
import kotlinx.serialization.KSerializer;
import kotlinx.serialization.SerializationException;
import kotlinx.serialization.SerializersKt;
import kotlinx.serialization.descriptors.PolymorphicKind;
import kotlinx.serialization.descriptors.SerialDescriptor;
import kotlinx.serialization.json.Json;
import org.springframework.core.GenericTypeResolver;
@@ -185,7 +188,7 @@ public class KotlinSerializationJsonHttpMessageConverter extends AbstractGeneric
KSerializer<Object> serializer = serializerCache.get(type);
if (serializer == null) {
serializer = SerializersKt.serializer(type);
if (serializer.getDescriptor().getKind().equals(PolymorphicKind.OPEN.INSTANCE)) {
if (hasPolymorphism(serializer.getDescriptor(), new HashSet<>())) {
throw new UnsupportedOperationException("Open polymorphic serialization is not supported yet");
}
serializerCache.put(type, serializer);
@@ -193,4 +196,18 @@ public class KotlinSerializationJsonHttpMessageConverter extends AbstractGeneric
return serializer;
}
private boolean hasPolymorphism(SerialDescriptor descriptor, Set<String> alreadyProcessed) {
alreadyProcessed.add(descriptor.getSerialName());
if (descriptor.getKind().equals(PolymorphicKind.OPEN.INSTANCE)) {
return true;
}
for (int i = 0 ; i < descriptor.getElementsCount() ; i++) {
SerialDescriptor elementDescriptor = descriptor.getElementDescriptor(i);
if (!alreadyProcessed.contains(elementDescriptor.getSerialName()) && hasPolymorphism(elementDescriptor, alreadyProcessed)) {
return true;
}
}
return false;
}
}