Re: [jsonb-dev] [External] : Refine polymorphic API

[David Kral <david.k.kral@xxxxxxxxxx>]

Hi Romain,

 

1. 301
   Yes, that is an issue, but I do not see the problem there if it is disabled by default and if allowed packages are required by the spec to be set. That’s exactly what the spec requires. In that case it is reasonably secure since it must be allowed by the user explicitly. Impl should not load the class until it verifies that the class is in the allowed package.
2. 302
   I will be honest here; I am not sure what API duplication are you talking about. I do not see anything wrong about adding this functionality. From my point of view, there is nothing wrong with having the format done over the enum.

 

David

 

Od: jsonb-dev <jsonb-dev-bounces@xxxxxxxxxxx> za uživatele Romain Manni-Bucau
Odesláno: čtvrtek 9. prosince 2021 11:40
Komu: jsonb developer discussions <jsonb-dev@xxxxxxxxxxx>
Předmět: [External] : [jsonb-dev] Refine polymorphic API

 

Hi all,

 

opened 2 issues we should tackle before next release on polymorphic topic:

 

- https://github.com/eclipse-ee4j/jsonb-api/issues/302

- https://github.com/eclipse-ee4j/jsonb-api/issues/301

 

Long story short we should ensure we are not dynamic at all on the types (301). This kind of behavior was introduced in existing (de)serialization libraries to mitigate the 0-day issue but it is not a solution so let's stick to a clean design for our first release please.

 

The other issue (302) is mainly about not wanting to do too much at first release and opening the door to a design we'll regret in release N+1 since we will get back to another duplication of API.

 

Overall our API should stick to:

 

@JsonbAnnotation
	@Retention(RetentionPolicy.RUNTIME)
	@Target({ElementType.ANNOTATION_TYPE, ElementType.TYPE})
	public @interface JsonbPolymorphicType {
	/**
	* Key used for keeping polymorphic information when {@link Format#PROPERTY} is chosen.
	* Default value is {@code @type}.
	*
	* @return key name
	*/
	String key() default "";
	/**
	* Allowed aliases of the given polymorphic type.
	*
	* @return list of allowed aliases
	*/
	JsonbSubtype[] value() default {};
	}

 

Overall it is way more important to ensure we can use (de)serializer in a portable manner to handle these requirements than addind and adding similar API which never cover all the users requirements so let's stay robust and simple and work on real underlying issues (keep in mind we worked on that before (de)serializers behavior was not defined enough originally so it is not only syntaxic sugar because we didn't do our homework ;)).

Romain Manni-Bucau
@rmannibucau |  Blog | Old Blog | Github | LinkedIn | Book