Skip to content

Replace improper JsonNode.toString() in Jackson support #4253

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 2 commits into from
Oct 30, 2017

Conversation

fpavageau
Copy link
Contributor

The pull-request addresses 2 issues:

  • Incorrect use of the Jackson API, by using JsonNode.toString() to serialize a sub-tree before deserializing it using an ObjectMapper.
  • Forced deserialization of the principal as User.

This fixes #4252.

  • I have signed the CLA

@fpavageau
Copy link
Contributor Author

By the way, I'm really interested in having the fix integrated in 4.2, I can rebase my branch on 4.2.x if necessary or helpful.

Not only is it more efficient without converting to an intermediate String,
using JsonNode.toString() may not even produce valid JSON according to its
Javadoc (ObjectMapper.writeValueAsString() should be used).
@fpavageau fpavageau force-pushed the jackson_session_support branch from 1c63948 to 2fe64ac Compare July 20, 2017 18:40
When the principal of the Authentication is an object, it is not necessarily
an User: it could be another implementation of UserDetails, or even a
completely unrelated type. Since the type of the object is serialized as a
property and used by the deserialization anyway, there's no point in
enforcing a stricter type.
@fpavageau fpavageau force-pushed the jackson_session_support branch from 2fe64ac to 10878d1 Compare July 20, 2017 22:05
@fpavageau
Copy link
Contributor Author

The branch has been rebased on master and adapted to the changes in #4370.

@rwinch rwinch merged commit 35706ad into spring-projects:master Oct 30, 2017
@rwinch rwinch self-assigned this Oct 30, 2017
@rwinch rwinch added type: bug A general bug in: core An issue in spring-security-core labels Oct 30, 2017
@rwinch rwinch added this to the 5.0.0.RC1 milestone Oct 30, 2017
@rwinch
Copy link
Member

rwinch commented Oct 30, 2017

Thanks for the PR @fpavageau! This is merged into master. If you would like to submit a PR for 4.2.x, I'd be glad to merge it

@fpavageau fpavageau deleted the jackson_session_support branch October 30, 2017 20:40
@rwinch rwinch changed the title Improved Jackson support for Spring Session Replace improper JsonNode.toString() in Jackson support Oct 30, 2017
@fpavageau
Copy link
Contributor Author

Hi @rwinch, thanks for merging.

I've submitted #4759 for 4.2.x.

@@ -50,10 +50,10 @@ public Set deserialize(JsonParser jp, DeserializationContext ctxt) throws IOExce
Iterator<JsonNode> nodeIterator = arrayNode.iterator();
while (nodeIterator.hasNext()) {
JsonNode elementNode = nodeIterator.next();
resultSet.add(mapper.readValue(elementNode.toString(), Object.class));
resultSet.add(mapper.readValue(elementNode.traverse(mapper), Object.class));

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

... just by chance noticed this. May have been changed since then, but method mapper.treeToValue() would perhaps be best method to use here. It does translate to very similar call so it's not a big deal either way, and code above works fine.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
in: core An issue in spring-security-core type: bug A general bug
Projects
None yet
Development

Successfully merging this pull request may close these issues.

Spring Session integration only supports User as the principal
3 participants