diff --git a/src/main/java/com/fasterxml/jackson/databind/jsontype/impl/SubTypeValidator.java b/src/main/java/com/fasterxml/jackson/databind/jsontype/impl/SubTypeValidator.java index 164ab3454..bdd3b2f4e 100644 --- a/src/main/java/com/fasterxml/jackson/databind/jsontype/impl/SubTypeValidator.java +++ b/src/main/java/com/fasterxml/jackson/databind/jsontype/impl/SubTypeValidator.java @@ -19,7 +19,10 @@ import com.fasterxml.jackson.databind.JsonMappingException; */ public class SubTypeValidator { - protected final static String PREFIX_STRING = "org.springframework."; + protected final static String PREFIX_SPRING = "org.springframework."; + + protected final static String PREFIX_C3P0 = "com.mchange.v2.c3p0."; + /** * Set of well-known "nasty classes", deserialization of which is considered dangerous * and should (and is) prevented by default. @@ -46,8 +49,9 @@ public class SubTypeValidator // [databind#1737]; 3rd party //s.add("org.springframework.aop.support.AbstractBeanFactoryPointcutAdvisor"); // deprecated by [databind#1855] s.add("org.springframework.beans.factory.config.PropertyPathFactoryBean"); - s.add("com.mchange.v2.c3p0.JndiRefForwardingDataSource"); - s.add("com.mchange.v2.c3p0.WrapperConnectionPoolDataSource"); + +// s.add("com.mchange.v2.c3p0.JndiRefForwardingDataSource"); // deprecated by [databind#1931] +// s.add("com.mchange.v2.c3p0.WrapperConnectionPoolDataSource"); // - "" - // [databind#1855]: more 3rd party s.add("org.apache.tomcat.dbcp.dbcp2.BasicDataSource"); s.add("com.sun.org.apache.bcel.internal.util.ClassLoader"); @@ -86,8 +90,10 @@ public class SubTypeValidator // 18-Dec-2017, tatu: As per [databind#1855], need bit more sophisticated handling // for some Spring framework types // 05-Jan-2017, tatu: ... also, only applies to classes, not interfaces - if (!raw.isInterface() && full.startsWith(PREFIX_STRING)) { - for (Class cls = raw; (cls != null) && (cls != Object.class); cls = cls.getSuperclass()) { + if (raw.isInterface()) { + ; + } else if (full.startsWith(PREFIX_SPRING)) { + for (Class cls = raw; (cls != null) && (cls != Object.class); cls = cls.getSuperclass()){ String name = cls.getSimpleName(); // looking for "AbstractBeanFactoryPointcutAdvisor" but no point to allow any is there? if ("AbstractPointcutAdvisor".equals(name) @@ -96,6 +102,16 @@ public class SubTypeValidator break main_check; } } + } else if (full.startsWith(PREFIX_C3P0)) { + // [databind#1737]; more 3rd party + // s.add("com.mchange.v2.c3p0.JndiRefForwardingDataSource"); + // s.add("com.mchange.v2.c3p0.WrapperConnectionPoolDataSource"); + // [databind#1931]; more 3rd party + // com.mchange.v2.c3p0.ComboPooledDataSource + // com.mchange.v2.c3p0.debug.AfterCloseLoggingComboPooledDataSource + if (full.endsWith("DataSource")) { + break main_check; + } } return; } while (false);