MNSTR-5023 backport security fix from jackson2 - 2 more gadgets from …

…(apache-drill, CVE-2020-14060) Merged from FasterXML/jackson-databind#2688
atlassian · Apr 20, 2021 · 9d9be96 · 9d9be96
1 parent f2d0a7c
commit 9d9be96
Showing 1 changed file with 2 additions and 0 deletions.
diff --git a/src/mapper/java/org/codehaus/jackson/map/jsontype/impl/SubTypeValidator.java b/src/mapper/java/org/codehaus/jackson/map/jsontype/impl/SubTypeValidator.java
@@ -177,6 +177,8 @@ public class SubTypeValidator
 
         // [databind#2688]: apache/drill
         s.add("oadd.org.apache.xalan.lib.sql.JNDIConnectionPool");
+        s.add("oadd.org.apache.commons.dbcp.datasources.PerUserPoolDataSource");
+        s.add("oadd.org.apache.commons.dbcp.datasources.SharedPoolDataSource");
 
         // [databind#2698]: weblogic w/ oracle/aq-jms
         // (note: dependency not available via Maven Central, but as part of