jackson-databind VS Hibernate

Jackson had this problem a few months back, where someone reported a critical CVE against the project and broke builds all around the planet https://github.com/FasterXML/jackson-databind/issues/3972

Basically the programmer (not the attacker) had to write code where an object contained itself

HashMap map=new HashMap<>();

map.put("recursive",map);

After this, Jackson would indeed stack overflow if you asked it to wrap the object to JSON. Then again, half the build-in Java functions (e.g. getting an object hashcode for the map object) also fail for a recursive structure.

The issue remains open 3 months later, Mitre still thinks it's hella serious, and people have yet again learned to just ignore their CI warning about CVEs

jackson-databind maintainer responds to a similar occurrence few weeks ago: https://github.com/FasterXML/jackson-databind/issues/3972#is...

As to Jackson itself see https://github.com/FasterXML/jackson-databind/issues/1970 for example on startup issues. There are others.

after reading https://github.com/FasterXML/jackson-databind/issues/2239 but setting JsonCreator and adding the JsonFormat didn't work.

Jackson should support records out of the box https://github.com/FasterXML/jackson-databind/issues/2709

Its not like this vulnerability is something new. Similar issues have been public knowledge for at least four years and discussed widely. The fact that str to int and int to str conversions are slow for huge ints is hardly news.

In C#, Newtonsoft Json has similar functionality, and in Java — Jackson2 ObjectMapper.

And Hibernate ORM is LGPL: see the license on their Github project.

13. Hibernate

Hibernate is the umbrella for a collection of libraries, most notably Hibernate ORM which provides Object/Relational Mapping for java domain objects. In addition to its own "native" API, Hibernate ORM is also an implementation of the Java Persistence API (jpa) specification.

I'm using Spring Data JPA as a persistence framework. Therefore, those classes are Hibernate entities.

I'm a top Hibernate contributor

Hibernate -- https://hibernate.org (huge learning curve)

This video is a crash course into the Hibernate & JPA universe.

To prevent SQL Injection attacks to sanitize input data. You can either validate every single input or validate using parameter binding. Parameter binding is mostly used by developers as it offers efficiency and security. If you are using a popular ORM such as sequelize, hibernate, etc then they already provide the functions to validate and sanitize your data. If you are using database modules other than ORM such as mysql for Node or Mongoose, you can use the escaping methods provided by the module. Let's learn by example. The codebase shown below is using mysql module for Node.