Jackson Work in Progress

Jackson WIP

This page is a "living document" of on-going work, mostly by @cowtowncoder (Tatu), although other committers are welcome to update it as well.

Contents are divided in 3 sections, of actionable (*) things:

1. Urgent things -- security problems, correctness (corruption), reliability (threading/concurrency)
2. Simple things -- low(er) hanging fruits that are likely easily fixable but also important (i.e. non-trivial)
3. Important -- things that important strategically, or highly "voted", but that are more involved to fix/implement.

as well as one "Recently Completed" addendum.

(*) actionable meaning, in general, that progress is only/mostly limited by time available and not by inherent difficulty, or lack of design or ideas of how to tackle the need.

Last updates

• 22-Nov-2018, tatu: Update completed entries, add new oens
• 29-Oct-2018, tatu: Create the initial version

Urgent things

Jackson 3.0: test failures for jackson-modules-base?

Jackson 2.10

• https://github.com/FasterXML/jackson-core/issues/479: rewrite BufferRecycler fix

Jackson 2.9

• https://github.com/FasterXML/jackson-databind/pull/2181: Don't re-use dynamic serializers for property-updating copy constructors

Simple Things

• Jackson 3.0
  • Remove mutability of JsonGenerator
  • https://github.com/FasterXML/jackson-databind/issues/2176: add JsonMapper.shared() (and ditto for other mappers)
  • https://github.com/FasterXML/jackson-databind/issues/2187: Make JsonNode.toString() work "as expected", remove code duplication, by using "shared" ObjectMapper` (see above)
• Jackson 2.10
  • Change JsonGenerator.Feature.ESCAPE_NON_ASCII to be based on JsonWriteFeature.ESCAPE_NON_ASCII
  • https://github.com/FasterXML/jackson-core/issues/495: Add StreamReadFeature as alias for remaining non-deprecated JsonParser.Features (for 3.0 forward compat)
  • https://github.com/FasterXML/jackson-core/issues/496: Add StreamWriteFeature as alias for remaining non-deprecated JsonGenerator.Features (for 3.0 forward compat)
  • https://github.com/FasterXML/jackson-core/issues/464: Add "maximum unescaped char" limit option in CharacterEscapes
  • https://github.com/FasterXML/jackson-databind/issues/2183: Base64 decoding, error messaging, default "no padding" encoding choice? (exception message maybe for 2.9?)
• Jackson 2.9
  • https://github.com/FasterXML/jackson-databind/issues/2167: Large Dates are formatted/serialized incorrectly

Important Things

• Jackson 3.0:
  • https://github.com/FasterXML/jackson-databind/issues/2177: Change parent type of JsonProcessingException to be RuntimeException
  • Finish partial rewrite of JsonFormat.Shape handling to support ALL changes (POJO to/from non-POJO), for types AND properties

---

Recently completed

2.8+

• 3 New CVEs for Polymorphic Deserialization gadgets (22-Nov-2018)
  • https://github.com/FasterXML/jackson-databind/issues/2186

2.9

DoS vectors via BigDecimal, BigInteger

Group of issues related to possible Denial-of-Service attacks, making use of surprisingly poor performance characteristics of coercing from BigInteger into long, and thereby also BigDecimal (as it is based on 2 BigIntegers). Mostly implemented by 29-Oct-2018, to be included in 2.9.8

• https://github.com/FasterXML/jackson-core/issues/488 -- low-level early-fail on coercion of BigInteger into int, long, float, double (29-Oct-2018)
• https://github.com/FasterXML/jackson-databind/issues/2157 -- tests for coercion of huge BigDecimal into Enum (basically verifying streaming API's early fail) (29-Oct-2018)
• https://github.com/FasterXML/jackson-modules-java8/issues/90 -- specific issue wrt BigDecimal, Instant deserializer (24-Oct-2018)

Jackson 3.0

• Simple: https://github.com/FasterXML/jackson-core/issues/492 (backtick in error messages) (30-Oct-2018)