Fix #3117

FasterXML · Apr 15, 2021 · 1687b02 · 1687b02
1 parent 27f62d3
commit 1687b02
Show file tree

Hide file tree

Showing 3 changed files with 39 additions and 3 deletions.
diff --git a/release-notes/VERSION-2.x b/release-notes/VERSION-2.x
@@ -27,6 +27,7 @@ Project: jackson-databind
  (contributed by David H)
 #3099: Optimize "AnnotatedConstructor.call()" case by passing explicit null
 #3101: Add AnnotationIntrospector.XmlExtensions interface for decoupling javax dependencies
+#3117: Use more limiting default visibility settings for JDK types (java.*, javax.*)
 - Fix to avoid problem with `BigDecimalNode`, scale of `Integer.MIN_VALUE` (see
   [dataformats-binary#264] for details)
 

diff --git a/src/main/java/com/fasterxml/jackson/databind/cfg/MapperConfigBase.java b/src/main/java/com/fasterxml/jackson/databind/cfg/MapperConfigBase.java
@@ -17,6 +17,7 @@
 import com.fasterxml.jackson.databind.jsontype.SubtypeResolver;
 import com.fasterxml.jackson.databind.jsontype.TypeResolverBuilder;
 import com.fasterxml.jackson.databind.type.TypeFactory;
+import com.fasterxml.jackson.databind.util.ClassUtil;
 import com.fasterxml.jackson.databind.util.RootNameLookup;
 
 @SuppressWarnings("serial")
@@ -713,8 +714,17 @@ public final VisibilityChecker<?> getDefaultVisibilityChecker()
 
     @Override // since 2.9
     public final VisibilityChecker<?> getDefaultVisibilityChecker(Class<?> baseType,
-            AnnotatedClass actualClass) {
-        VisibilityChecker<?> vc = getDefaultVisibilityChecker();
+            AnnotatedClass actualClass)
+    {
+        // 14-Apr-2021, tatu: [databind#3117] JDK types should be limited
+        //    to "public-only" regardless of settings for other types
+        VisibilityChecker<?> vc;
+
+        if (ClassUtil.isJDKClass(baseType)) {
+            vc = VisibilityChecker.Std.allPublicInstance();
+        } else {
+            vc = getDefaultVisibilityChecker();
+        }
         AnnotationIntrospector intr = getAnnotationIntrospector();
         if (intr != null) {
             vc = intr.findAutoDetectVisibility(actualClass, vc);

diff --git a/src/main/java/com/fasterxml/jackson/databind/introspect/VisibilityChecker.java b/src/main/java/com/fasterxml/jackson/databind/introspect/VisibilityChecker.java
@@ -169,13 +169,38 @@ public static class Std
                 Visibility.PUBLIC_ONLY // field
                 );
 
+        /**
+         * Alternate base settings used for JDK types: public visibility
+         * required for everything
+         *
+         * @since 2.13
+         */
+        protected final static Std ALL_PUBLIC = new Std(
+                Visibility.PUBLIC_ONLY, // getter
+                Visibility.PUBLIC_ONLY, // is-getter
+                Visibility.PUBLIC_ONLY, // setter
+                Visibility.PUBLIC_ONLY, // creator (single-arg ctors)
+                Visibility.PUBLIC_ONLY // field
+        );
+
         protected final Visibility _getterMinLevel;
         protected final Visibility _isGetterMinLevel;
         protected final Visibility _setterMinLevel;
         protected final Visibility _creatorMinLevel;
         protected final Visibility _fieldMinLevel;
-
+
+        /**
+         * @return Instance with default settings: "public" for getters/is-getters,
+         *    fields; "any" for setters and legacy 1-arg constructors
+         */
         public static Std defaultInstance() { return DEFAULT; }
+
+        /**
+         * @return Instance with all visibility levels set to "public"
+         *
+         * @since 2.13
+         */
+        public static Std allPublicInstance() { return ALL_PUBLIC; }
 
         /**
          * Constructor used for building instance that has minumum visibility