[pjfanning]

Fixes #1297

ServiceInstance#getPayload() (and OldServiceInstance) is annotated with @JsonTypeInfo(use = JsonTypeInfo.Id.CLASS), so JsonInstanceSerializer would load any class named in the JSON, relying only on Jackson's built-in gadget deny-list.

Changes

• JsonInstanceSerializer now sets a PolymorphicTypeValidator on its ObjectMapper. By default:
  • polymorphic values with an Object base type (i.e. the erased payload T) must be the configured payloadClass or a subtype; anything else fails with InvalidTypeIdException
  • polymorphic values with any other declared base type (e.g. a nested @JsonTypeInfo field inside the user's payload) are allowed as before, so existing payloads with their own typed fields keep working
• New public constructor JsonInstanceSerializer(Class<T>, boolean, PolymorphicTypeValidator) for users who need a different policy.
• Users who pass Object.class as the payload class keep the previous (permissive) behaviour; they can use the new constructor to lock it down.

Related

• chore: Upgrade jackson-version to 2.18.11 #1296 upgrades Jackson to 2.18.11. With 2.18.1, Jackson resolves the class named in the type id via Class.forName(name, true, loader), so a class's static initializer runs before the validator can reject it; newer versions load without initializing. This PR should go in alongside chore: Upgrade jackson-version to 2.18.11 #1296.

Tests

• disallowed payload class is rejected
• custom validator allows/denies as configured
• payload with a nested Id.CLASS field still round-trips

🤖 Generated with Claude Code

[pjfanning]

@eolivelli this new polymorphic type validator may be a breaking change for some users and they would need to use the new constructor to provide their own polymorphic type validator.