diff --git a/release-notes/VERSION-2.x b/release-notes/VERSION-2.x index f67053b604..558ef5bb40 100644 --- a/release-notes/VERSION-2.x +++ b/release-notes/VERSION-2.x @@ -8,6 +8,8 @@ Project: jackson-databind #2688: Block one more gadget type (apache-drill) (reported by Topsec(tcc)) +#2698: Block one more gadget type (weblogic/oracle-aqjms) + (reported by Fangrun Li) 2.9.10.4 (11-Apr-2020) diff --git a/src/main/java/com/fasterxml/jackson/databind/jsontype/impl/SubTypeValidator.java b/src/main/java/com/fasterxml/jackson/databind/jsontype/impl/SubTypeValidator.java index a7853c026b..20bbf20592 100644 --- a/src/main/java/com/fasterxml/jackson/databind/jsontype/impl/SubTypeValidator.java +++ b/src/main/java/com/fasterxml/jackson/databind/jsontype/impl/SubTypeValidator.java @@ -183,6 +183,15 @@ public class SubTypeValidator // [databind#2688]: apache/drill s.add("oadd.org.apache.xalan.lib.sql.JNDIConnectionPool"); + // [databind#2698]: weblogic w/ oracle/aq-jms + // (note: dependency not available via Maven Central, but as part of + // weblogic installation, possibly fairly old version(s)) + s.add("oracle.jms.AQjmsQueueConnectionFactory"); + s.add("oracle.jms.AQjmsXATopicConnectionFactory"); + s.add("oracle.jms.AQjmsTopicConnectionFactory"); + s.add("oracle.jms.AQjmsXAQueueConnectionFactory"); + s.add("oracle.jms.AQjmsXAConnectionFactory"); + DEFAULT_NO_DESER_CLASS_NAMES = Collections.unmodifiableSet(s); }