Jackson Work in Progress

Jackson WIP

This page is a "living document" of on-going work, mostly by @cowtowncoder (Tatu), although other committers are welcome to update it as well.

Contents are divided in 3 sections, of actionable (*) things:

1. Urgent things -- security problems, correctness (corruption), reliability (threading/concurrency)
2. Simple things -- low(er) hanging fruits that are likely easily fixable but also important (i.e. non-trivial)
3. Important -- things that important strategically, or highly "voted", but that are more involved to fix/implement.

(*) actionable meaning, in general, that progress is only/mostly limited by time available and not by inherent difficulty, or lack of design or ideas of how to tackle the need.

Last updates

29-Oct-2018, tatu: Create the initial version

Urgent things

DoS vectors via BigDecimal, BigInteger

Group of issues related to possible Denial-of-Service attacks, making use of surprisingly poor performance characteristics of coercing from BigInteger into long, and thereby also BigDecimal (as it is based on 2 BigIntegers). Mostly implemented by 29-Oct-2018, to be included in 2.9.8

• https://github.com/FasterXML/jackson-core/issues/488 -- low-level early-fail on coercion of BigInteger into int, long, float, double
• https://github.com/FasterXML/jackson-databind/issues/2157 -- tests for coercion of huge BigDecimal into Enum (basically verifying streaming API's early fail)
• https://github.com/FasterXML/jackson-modules-java8/issues/90 -- specific issue wrt BigDecimal, Instant deserializer

New CVEs for Polymorphic Deserialization gadgets

• On 29-Oct-2018, 3 more gadgets were reported. More information will sent to jackson-dev-infosec list; fixes for 2.9.8 and 2.8.11.3

Simple Things

• Jackson 3.0:
  • Remove mutability of JsonGenerator
  • https://github.com/FasterXML/jackson-core/issues/492 (backtick in error messages) (ok sort of trivial)
• Jackson 2.10:
  • Change JsonGenerator.Feature.ESCAPE_NON_ASCII to be based on JsonWriteFeature.ESCAPE_NON_ASCII
    • Maybe implement
  • Add StreamReadFeature as alias for remaining non-deprecated JsonParser.Features (for 3.0 forward compat)
  • Add StreamWriteFeature as alias for remaining non-deprecated JsonGenerator.Features (for 3.0 forward compat)

Important Things

• Jackson 3.0:
  • Test failures for jackson-modules-base?
  • Finish partial rewrite of JsonFormat.Shape handling to support ALL changes (POJO to/from non-POJO), for types AND properties