Jackson Work in Progress

Jackson WIP

This page is a "living document" of on-going work, mostly by @cowtowncoder (Tatu), although other committers are welcome to update it as well.

Contents are divided in 3 sections, of actionable (*) things:

1. Urgent things -- security problems, correctness (corruption), reliability (threading/concurrency)
2. Simple things -- low(er) hanging fruits that are likely easily fixable but also important (i.e. non-trivial)
3. Important -- things that important strategically, or highly "voted", but that are more involved to fix/implement.

as well as one "Recently Completed" addendum.

(*) actionable meaning, in general, that progress is only/mostly limited by time available and not by inherent difficulty, or lack of design or ideas of how to tackle the need.

Last updates

• 10-Dec-2018, tatu: Update completed entries
• 22-Nov-2018, tatu: Update completed entries, add new ones
• 29-Oct-2018, tatu: Create the initial version

Urgent things

Jackson 3.0: test failures for jackson-modules-base?

Jackson 2.10

• https://github.com/FasterXML/jackson-core/issues/479: rewrite BufferRecycler fix
• https://github.com/FasterXML/jackson-core/issues/498: better Java 9+ module name support with moditect Maven plug-in (https://github.com/moditect/moditect)

Simple Things

• Jackson 3.0
  • Streaming
    • Remove mutability of JsonGenerator
  • Databind
• Jackson 2.10
  • Streaming
    • Change JsonGenerator.Feature.ESCAPE_NON_ASCII to be based on JsonWriteFeature.ESCAPE_NON_ASCII
    • https://github.com/FasterXML/jackson-core/issues/495: Add StreamReadFeature as alias for remaining non-deprecated JsonParser.Features (for 3.0 forward compat)
    • https://github.com/FasterXML/jackson-core/issues/496: Add StreamWriteFeature as alias for remaining non-deprecated JsonGenerator.Features (for 3.0 forward compat)
    • https://github.com/FasterXML/jackson-core/issues/464: Add "maximum unescaped char" limit option in CharacterEscapes
  • Databind
    • https://github.com/FasterXML/jackson-databind/pull/2196: Type safety wrt TypeReference, ObjectMapper.readValue()
  • Dataformats
    • https://github.com/FasterXML/jackson-dataformats-binary/issues/73: References to nested types
  • Other
    • (java 8 date/time) https://github.com/FasterXML/jackson-modules-java8/pull/92: (Java 8 date/time) format support for Duration (maybe?)
• Jackson 2.9

Important Things

• Jackson 3.0:
  • https://github.com/FasterXML/jackson-databind/issues/2177: Change parent type of JsonProcessingException to be RuntimeException (maybe UncheckedIOException?)
  • Finish partial rewrite of JsonFormat.Shape handling to support ALL changes (POJO to/from non-POJO), for types AND properties
• Jackson 2.10:
  • https://github.com/FasterXML/jackson-databind/issues/2189: Bounds checks (int, long) for TreeTraversingParser (and verify TokenBuffer's too)
  • https://github.com/FasterXML/jackson-core/issues/500: allow "optional padding" for base64 (not just required/not-allowed choices)

---

Recently completed

Here are things since October 2018 (before release of 2.9.8).

2.8+

• 3 New CVEs for Polymorphic Deserialization gadgets (22-Nov-2018)
  • https://github.com/FasterXML/jackson-databind/issues/2186

2.9

DoS vectors via BigDecimal, BigInteger

Group of issues related to possible Denial-of-Service attacks, making use of surprisingly poor performance characteristics of coercing from BigInteger into long, and thereby also BigDecimal (as it is based on 2 BigIntegers). Mostly implemented by 29-Oct-2018, to be included in 2.9.8

• https://github.com/FasterXML/jackson-core/issues/488 -- low-level early-fail on coercion of BigInteger into int, long, float, double (29-Oct-2018)
• https://github.com/FasterXML/jackson-databind/issues/2157 -- tests for coercion of huge BigDecimal into Enum (basically verifying streaming API's early fail) (29-Oct-2018)
• https://github.com/FasterXML/jackson-modules-java8/issues/90 -- specific issue wrt BigDecimal, Instant deserializer (24-Oct-2018)

Misc

• https://github.com/FasterXML/jackson-databind/issues/2167: Large Dates are formatted/serialized incorrectly (22-Nov-2018)
• https://github.com/FasterXML/jackson-databind/pull/2181: Don't re-use dynamic serializers for property-updating copy constructors (22-Nov-2018)
• https://github.com/FasterXML/jackson-databind/issues/2183: Base64 decoding, error messaging, default "no padding" encoding choice? (22-Nov-2018)
• https://github.com/FasterXML/jackson-dataformats-binary/issues/153: (Smile) Decorator not working for gzip (28-Nov-2018)
• https://github.com/FasterXML/jackson-dataformats-binary/issues/140: (protobuf) Stack overflow when generating Protobuf schema on class containing OffsetDatetime field
• https://github.com/FasterXML/jackson-dataformat-xml/pull/323: (XML) Replace slow string concatenation with faster StringBuilder (for long text content)

2.10

Streaming

Databind

• https://github.com/FasterXML/jackson-databind/issues/2187: Make JsonNode.toString() work "as expected", remove code duplication, by using "shared" ObjectMapper` (10-Dec-2018)
• https://github.com/FasterXML/jackson-databind/issues/2204: Add JsonNode.isEmpty() as convenience alias (10-Dec-2018)

Dataformats

• https://github.com/FasterXML/jackson-dataformats-binary/issues/139: (cbor) Incorrect decimal fraction representation (27-Nov-2018)

Jackson 3.0

Streaming

• https://github.com/FasterXML/jackson-core/issues/492 (backtick in error messages) (30-Oct-2018)

Databind

• https://github.com/FasterXML/jackson-databind/issues/2176: add JsonMapper.shared() (and ditto for other mappers) (10-Dec-2018)