Validate generic type arguments (simplified alternative to #6254)

[martinfrancois]

Alternative to #6254

---

Summary by Gitar

• Validation improvements:
  • Validate generic type arguments against declared type parameters of base type in DatabindContext
  • Add BaseTypeAllowingValidator and _validateGenericSubType hook for unsafe class checks

_{This will update automatically on new commits.}

[gitar-bot]

⚠️ Bug: Denied declared base type rejects type arguments that used to pass

_validateTypeParameter now calls ptv.validateBaseType(config, declaredType) for every type argument and throws right away on DENIED. declaredType is often the unknown type (Object), because it stands in for unbound, wildcard, Object and subtype-only parameters. So a BasicPolymorphicTypeValidator built with denyForExactBaseType(Object.class) plus allowIfSubType("com.example.") will now reject ids like java.util.ArrayList<com.example.Foo> for a List<Object> or Map<String,Object> base. Before this change, the same argument was approved through validateSubClassName, and that rule still passes on the name check.

The top-level path only calls validateBaseType once, when the type deserializer is built; it is not re-checked for each type id. This PR applies it to a type the user never declared as a polymorphic base, which breaks existing configurations in a patch release. Fix: treat DENIED from the declared parameter's base check like INDETERMINATE and fall through to the name- and class-based checks, or skip the base check when declaredType is Object/unknown.

_{Was this helpful? React with 👍 / 👎}

[martinfrancois]

Intended. The declared type argument is treated as the base type in both directions: allowIfBaseType(X) approves subtypes of X as arguments, and denyForExactBaseType(X) rejects them, the same way both work for the top-level type. Letting a DENIED fall through to the name checks would make an Object argument easier to pass than an Object property. Jackson itself only writes generic type ids for EnumSet and EnumMap, where the arguments are enums (exempt from the PTV) or Object (skipped), so ids Jackson wrote are unaffected.

[gitar-bot]

Gitar can change code and merge on your behalf, so it only acts on requests from people who can push. This needs Write access to this repository.

[gitar-bot]

Code Review ⚠️ Changes requested 0 closed / 1 findings

🔴 High risk · Polymorphic deserialization now validates generic arguments against declared types and subtype rules

Adds validation of generic type arguments during type factory operations, but the check against the declared base type now rejects valid type arguments that previously passed. When a BasicPolymorphicTypeValidator denies Object.class as a base type, type arguments like java.util.ArrayList<com.example.Foo> are incorrectly rejected for declarations like List<Object> or Map<String,Object>, breaking existing configurations. Treat DENIED results from declared parameter base checks as indeterminate to fall through to name- and class-based validation, or skip the base check when the declared type is Object or unknown.

⚠️ Bug: Denied declared base type rejects type arguments that used to pass

📄 src/main/java/com/fasterxml/jackson/databind/DatabindContext.java:385-390

_validateTypeParameter now calls ptv.validateBaseType(config, declaredType) for every type argument and throws right away on DENIED. declaredType is often the unknown type (Object), because it stands in for unbound, wildcard, Object and subtype-only parameters. So a BasicPolymorphicTypeValidator built with denyForExactBaseType(Object.class) plus allowIfSubType("com.example.") will now reject ids like java.util.ArrayList<com.example.Foo> for a List<Object> or Map<String,Object> base. Before this change, the same argument was approved through validateSubClassName, and that rule still passes on the name check.

The top-level path only calls validateBaseType once, when the type deserializer is built; it is not re-checked for each type id. This PR applies it to a type the user never declared as a polymorphic base, which breaks existing configurations in a patch release. Fix: treat DENIED from the declared parameter's base check like INDETERMINATE and fall through to the name- and class-based checks, or skip the base check when declaredType is Object/unknown.

🤖 Prompt for agents

Code Review: Adds validation of generic type arguments during type factory operations, but the check against the declared base type now rejects valid type arguments that previously passed. When a `BasicPolymorphicTypeValidator` denies `Object.class` as a base type, type arguments like `java.util.ArrayList<com.example.Foo>` are incorrectly rejected for declarations like `List<Object>` or `Map<String,Object>`, breaking existing configurations. Treat `DENIED` results from declared parameter base checks as indeterminate to fall through to name- and class-based validation, or skip the base check when the declared type is `Object` or unknown.

1. ⚠️ Bug: Denied declared base type rejects type arguments that used to pass
   Files: src/main/java/com/fasterxml/jackson/databind/DatabindContext.java:385-390

   `_validateTypeParameter` now calls `ptv.validateBaseType(config, declaredType)` for every type argument and throws right away on `DENIED`. `declaredType` is often the unknown type (`Object`), because it stands in for unbound, wildcard, `Object` and subtype-only parameters. So a `BasicPolymorphicTypeValidator` built with `denyForExactBaseType(Object.class)` plus `allowIfSubType("com.example.")` will now reject ids like `java.util.ArrayList<com.example.Foo>` for a `List<Object>` or `Map<String,Object>` base. Before this change, the same argument was approved through `validateSubClassName`, and that rule still passes on the name check.
   
   The top-level path only calls `validateBaseType` once, when the type deserializer is built; it is not re-checked for each type id. This PR applies it to a type the user never declared as a polymorphic base, which breaks existing configurations in a patch release. Fix: treat `DENIED` from the declared parameter's base check like `INDETERMINATE` and fall through to the name- and class-based checks, or skip the base check when `declaredType` is `Object`/unknown.

Review coverage

📋 Rules No rules evaluated

🧪 Functional validation Not enabled · Set up

Options

Auto-apply is off → Gitar will not commit updates to this branch.
Display: compact → Counting what did not apply, without listing it.

Comment with these commands to change the behavior for this request:

Auto-apply	Compact
gitar auto-apply:on	gitar display:verbose

_{Was this helpful? React with 👍 / 👎 | Powered by Gitar — free for open source}