From 9593e16cf5a3d289a9c584f7123639655de9ddac Mon Sep 17 00:00:00 2001 From: Tatu Saloranta Date: Sat, 28 Sep 2019 18:39:17 -0700 Subject: [PATCH] Fix #2478 (cve) --- .../jackson/databind/jsontype/impl/SubTypeValidator.java | 4 ++++ 1 files changed, 4 insertions(+) diff --git a/src/main/java/com/fasterxml/jackson/databind/jsontype/impl/SubTypeValidator.java b/src/main/java/com/fasterxml/jackson/databind/jsontype/impl/SubTypeValidator.java index 4fad2d012..4e7f162f4 100644 --- a/src/main/java/com/fasterxml/jackson/databind/jsontype/impl/SubTypeValidator.java +++ b/src/main/java/com/fasterxml/jackson/databind/jsontype/impl/SubTypeValidator.java @@ -114,6 +114,10 @@ public class SubTypeValidator // [databind#2469]: xalan2 s.add("org.apache.xalan.lib.sql.JNDIConnectionPool"); + // [databind#2478]: comons-dbcp, p6spy + s.add("org.apache.commons.dbcp.datasources.SharedPoolDataSource"); + s.add("com.p6spy.engine.spy.P6DataSource"); + DEFAULT_NO_DESER_CLASS_NAMES = Collections.unmodifiableSet(s); } -- 2.23.0