From 9cd6166df7d14f0e29e29b059e236aa778b7db0d Mon Sep 17 00:00:00 2001 From: PJ Fanning Date: Wed, 8 Jul 2026 21:06:21 +0100 Subject: [PATCH] jackson MINIMAL_CLASS setting is dangerous too (#3304) --- docs/src/main/paradox/serialization-jackson.md | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/docs/src/main/paradox/serialization-jackson.md b/docs/src/main/paradox/serialization-jackson.md index dfd0a7bcad2..d6884b3665b 100644 --- a/docs/src/main/paradox/serialization-jackson.md +++ b/docs/src/main/paradox/serialization-jackson.md @@ -77,8 +77,8 @@ and disallowed for deserialization. @@@ warning -Don't use @javadoc[@JsonTypeInfo(use = Id.CLASS)](com.fasterxml.jackson.annotation.JsonTypeInfo) or @javadoc[ObjectMapper.enableDefaultTyping](com.fasterxml.jackson.databind.ObjectMapper#enableDefaultTyping--) since that is a security risk -when using @ref:[polymorphic types](#polymorphic-types). +Don't use @javadoc[@JsonTypeInfo(use = Id.CLASS)](com.fasterxml.jackson.annotation.JsonTypeInfo), @javadoc[@JsonTypeInfo(use = Id.MINIMAL_CLASS)](com.fasterxml.jackson.annotation.JsonTypeInfo) +or @javadoc[ObjectMapper.enableDefaultTyping](com.fasterxml.jackson.databind.ObjectMapper#enableDefaultTyping--) since that is a security risk when using @ref:[polymorphic types](#polymorphic-types). @@@ @@ -156,8 +156,8 @@ when deserializing. @@@ warning -Don't use @javadoc[@JsonTypeInfo(use = Id.CLASS)](com.fasterxml.jackson.annotation.JsonTypeInfo) or @javadoc[ObjectMapper.enableDefaultTyping](com.fasterxml.jackson.databind.ObjectMapper#enableDefaultTyping--) since that is a security risk -when using polymorphic types. +Don't use @javadoc[@JsonTypeInfo(use = Id.CLASS)](com.fasterxml.jackson.annotation.JsonTypeInfo), @javadoc[@JsonTypeInfo(use = Id.MINIMAL_CLASS)](com.fasterxml.jackson.annotation.JsonTypeInfo) +or @javadoc[ObjectMapper.enableDefaultTyping](com.fasterxml.jackson.databind.ObjectMapper#enableDefaultTyping--) since that is a security risk when using @ref:[polymorphic types](#polymorphic-types). @@@