dixmont

Repository Relocation

Development of this project has moved to an open-source but not open-contribution model.

Source code and commits will remain publicly available perpetually, but issues and/or pull requests will be rejected and/or ignored. Additionally, this project will now only be available via a read-only mirror at:

https://codeberg.org/io7m-com/dixmont

dixmont

Some useful extension classes for jackson.

Features

• Restricted JSON deserializer for preventing reflection-based serialization attacks.
• Written in pure Java 17.
• OSGi ready.
• JPMS ready.
• ISC license.
• High-coverage automated test suite.

Motivation

Systems that use reflection to deserialize data are typically subject to deserialization attacks. The jackson JSON library is no exception to this.

The dixmont package provides a blunt and brute-force means to reduce the impact of attacks: All of the permitted classes that can be deserialized are listed, and everything else is rejected.

Building

$ mvn clean verify

Usage

Create a restricted serializer that is permitted to deserialize only the given classes and no others, and then register it with a mapper:

var builder =
  DmJsonRestrictedDeserializers.builder();

// Allow deserializing values of various "value" classes...
builder.allowClass(Path.class)
  .allowClass(String.class)
  .allowClass(URI.class)
  .allowClass(int.class)
  .allowClass(double.class);

// Allow java.util.Optional<java.lang.Integer>
builder.allowOptionalOfClass(Integer.class);

// Or, equivalently:
builder.allowClassName("java.util.Optional<java.lang.Integer>")

// Allow java.util.List<java.lang.String>
builder.allowListsOfClass(String.class);

// Or, equivalently:
builder.allowClassName("java.util.List<java.lang.String>");

// Allow java.util.Set<java.lang.String>
builder.allowSetsOfClass(String.class);

// Or, equivalently:
builder.allowClassName("java.util.Set<java.lang.String>");

// Allow java.util.Map<java.lang.Integer, java.lang.String>
builder.allowMapsOfClass(Integer.class, String.class);

// Or, equivalently:
builder.allowClassName("java.util.Map<java.lang.Integer, java.lang.String>");

final var serializers = builder.build();
final var simpleModule = new SimpleModule();
simpleModule.setDeserializers(serializers);

final var mapper =
  JsonMapper.builder()
    .addModule(simpleModule)
    .build();

Parser code using the given ObjectMapper will be prevented from deserializing values of anything other than the given classes. Hostile JSON text that attempts to get the deserializer to instantiate other classes will fail.