Class JacksonSerializationStrategy

  • All Implemented Interfaces:
    SerializationStrategy

    public class JacksonSerializationStrategy
    extends Object
    implements SerializationStrategy
    SerializationStrategy using Jackson to serialize and deserialize data.

    ATTENTION This class uses Jacksons objectMapper.enableDefaultTyping(); feature. When unvalidated data is written to the session this could lead to code execution via so called serialization gadgets.

    ATTENTION As jackson has more limitations, in what it can serialize and deserialize and under which conditions, be super careful about the data stored in the session. Consider compiling with -parameters otherwise constructors have to be annotated with JsonCreator.

    E.g. for maven

    
     <plugin>
       <groupId>org.apache.maven.plugins</groupId>
       <artifactId>maven-compiler-plugin</artifactId>
       <configuration>
         <compilerArgs>
           <arg>-verbose</arg>
           <arg>-parameters</arg>
           <arg>-Xlint:all</arg>
         </compilerArgs>
       </configuration>
     </plugin>