The class with java.sql.Timestamp is not whitelisted.

[miladamery]

Summary

Hi. In my project i use spring session with redis to store our session and share it. due to reasons we decided to use json serialization instead of jdk serialization. here is configuration for this based on spring session sample app.

@Configuration
public class SessionConfig implements BeanClassLoaderAware {

	private ClassLoader loader;

	@Bean
	public RedisSerializer<Object> springSessionDefaultRedisSerializer() {
		return new GenericJackson2JsonRedisSerializer(objectMapper());
	}

	/**
	 * Customized {@link ObjectMapper} to add mix-in for class that doesn't have default
	 * constructors
	 *
	 * @return the {@link ObjectMapper} to use
	 */
	private ObjectMapper objectMapper() {
		ObjectMapper mapper = new ObjectMapper();
                SecurityJackson2Modules.enableDefaultTyping(mapper);
		mapper.registerModules(SecurityJackson2Modules.getModules(this.loader));
		return mapper;
	}

	/*
	 * (non-Javadoc)
	 *
	 * @see
	 * org.springframework.beans.factory.BeanClassLoaderAware#setBeanClassLoader(java.lang
	 * .ClassLoader)
	 */
	@Override
	public void setBeanClassLoader(ClassLoader classLoader) {
		this.loader = classLoader;
	}
}

But i get following error.

com.fasterxml.jackson.databind.JsonMappingException: The class with java.sql.Timestamp and name of java.sql.Timestamp is not whitelisted. If you believe this class is safe to deserialize, please provide an explicit mapping using Jackson annotations or by providing a Mixin. If the serialization is only done by a trusted source, you can also enable default typing. See https://github.com/spring-projects/spring-security/issues/4370 for details (through reference chain: org.springframework.security.core.context.SecurityContextImpl["authentication"]->org.baharan.framework.model.security.User["lastVisitDate"])

The thing is that lastVisitDate field type is Date. its not Timestamp. i appreciate it if you help me in this. thanks in advance.

Version

Spring Boot 2.1.1.RELEASE

[clevertension]

can you paste the code of org.baharan.framework.model.security.User

[miladamery]

Here is its code. User is a hibernate entity but configured via hbm.xml. in my class that implements UsetDetailsService i retrieve User from databse and return it.

import java.io.Serializable;
import java.util.Collection;
import java.util.Date;
import java.util.HashSet;
import java.util.Set;

import org.springframework.security.core.GrantedAuthority;
import org.springframework.security.core.userdetails.UserDetails;

import com.fasterxml.jackson.annotation.JsonIgnore;
import com.fasterxml.jackson.annotation.JsonProperty;

public class User implements UserDetails {

	private static final long serialVersionUID = -8655025698623213538L;
	
	private Integer id;	
	private String fullName;
	private String userName;
	private String passWord;
	private String email;
	private int visitedCount;
	private Date lastVisitDate;
	private boolean enabled;
	private boolean online;

	private Set<Group> groups = new HashSet<Group>(0);
	private Set<Action> actions = new HashSet<Action>(0);

	private boolean forceUserChangePassword;
	private boolean lock;
	private Set<GrantedAuthority> authorities;
	private String passwordCredit;
	private String userCredit;
	private long userLockDate;

	public User() {
	}

	public User(Integer id) {
		super.setId(id);
	}

	public User(Integer id, String firstName, String lastName) {
		super.setId(id);
		this.personel = new BasePersonel();
		this.personel.setFirstName(firstName);
		this.personel.setLastName(lastName);
	}
	
	public User(String userName, String passWord, String email) {
		super();
		this.userName = userName;
		this.passWord = passWord;
		this.email = email;
	}

	public String getUserName() {
		return userName;
	}

	public void setUserName(String userName) {
		this.userName = userName;
	}

	public String getPassWord() {
		return passWord;
	}

	public void setPassWord(String passWord) {
		this.passWord = passWord;
	}

	public String getEmail() {
		return email;
	}

	public void setEmail(String email) {
		this.email = email;
	}

	public int getVisitedCount() {
		return visitedCount;
	}

	public void setVisitedCount(int visitedCount) {
		this.visitedCount = visitedCount;
	}

	public Date getLastVisitDate() {
		return lastVisitDate;
	}

	public void setLastVisitDate(Date lastVisitDate) {
		this.lastVisitDate = lastVisitDate;
	}

	@JsonIgnore
	public Set<Group> getGroups() {
		return groups;
	}

	public void setGroups(Set<Group> groups) {
		this.groups = groups;
	}

	public void setAuthorities(Set<GrantedAuthority> authorities) {
		this.authorities = authorities;
	}

	@JsonIgnore
	@Override
	public Collection<? extends GrantedAuthority> getAuthorities() {
		return authorities;
	}

	@Override
	public String getPassword() {
		return getPassWord();
	}

	@Override
	public String getUsername() {
		return getUserName();
	}

	@JsonIgnore
	@Override
	public boolean isAccountNonExpired() {
		return true;
	}

	@JsonIgnore
	@Override
	public boolean isAccountNonLocked() {
		return true;
	}

	@JsonIgnore
	@Override
	public boolean isCredentialsNonExpired() {
		return true;
	}


	public void setForceUserChangePassword(boolean forceUserChangePassword) {
		this.forceUserChangePassword = forceUserChangePassword;
	}

	public boolean isForceUserChangePassword() {
		return forceUserChangePassword;
	}

	public void setLock(boolean lock) {
		this.lock = lock;
	}

	public boolean isLock() {
		return lock;
	}

	@JsonIgnore
	public Set<Action> getActions() {
		return actions;
	}

	@JsonProperty
	public void setActions(Set<Action> actions) {
		this.actions = actions;
	}

	public long getUserLockDate() {
		return userLockDate;
	}

	public void setUserLockDate(long userLockDate) {
		this.userLockDate = userLockDate;
	}

	public void setFullName(String fullName) {
		this.fullName = fullName;
	}

	public boolean isEnabled() {
		return enabled;
	}

	public void setEnabled(boolean enabled) {
		this.enabled = enabled;
	}

	public void setUserCredit(String userCredit) {
		this.userCredit = userCredit;
	}

	public String getUserCredit() {
		return userCredit;
	}

	public void setPasswordCredit(String passwordCredit) {
		this.passwordCredit = passwordCredit;
	}

	public String getPasswordCredit() {
		return passwordCredit;
	}

	public boolean isOnline() {
		return online;
	}

	public void setOnline(boolean online) {
		this.online = online;
	}

	@Override
	public boolean equals(Object otherUser) {
		if (otherUser.hashCode() == hashCode())
			return true;

		return false;
	}

	@Override
	public int hashCode() {
		return this.getId();
	}

	public void setPassword(String password) {
		this.passWord = password;
	}

	public void setUsername(String username) {
		this.userName = username;
	}
}

[clevertension]

it is clearly that java.sql.Timestamp is a subclass of java.util.Date

so i think hibernate set java.sql.Timestamp to your lastVisitDate, but the Spring Security check type with class name, so it can't accept this type, so in order to resolve this issue, you need to some extra hibernate annotation, for example

@Temporal(TemporalType.DATE)
private Date lastVisitDate;

it is definitely not the Spring Security bug, but i think Spring Security can provide a more loosely check to allow all the sub classes

[miladamery]

Thanks for your answer. what you said is true. so will Spring Security provide that loosely check?