jackson-databind VS record-builder

Jackson had this problem a few months back, where someone reported a critical CVE against the project and broke builds all around the planet https://github.com/FasterXML/jackson-databind/issues/3972

Basically the programmer (not the attacker) had to write code where an object contained itself

HashMap map=new HashMap<>();

map.put("recursive",map);

After this, Jackson would indeed stack overflow if you asked it to wrap the object to JSON. Then again, half the build-in Java functions (e.g. getting an object hashcode for the map object) also fail for a recursive structure.

The issue remains open 3 months later, Mitre still thinks it's hella serious, and people have yet again learned to just ignore their CI warning about CVEs

jackson-databind maintainer responds to a similar occurrence few weeks ago: https://github.com/FasterXML/jackson-databind/issues/3972#is...

As to Jackson itself see https://github.com/FasterXML/jackson-databind/issues/1970 for example on startup issues. There are others.

after reading https://github.com/FasterXML/jackson-databind/issues/2239 but setting JsonCreator and adding the JsonFormat didn't work.

Jackson should support records out of the box https://github.com/FasterXML/jackson-databind/issues/2709

Its not like this vulnerability is something new. Similar issues have been public knowledge for at least four years and discussed widely. The fact that str to int and int to str conversions are slow for huge ints is hardly news.

In C#, Newtonsoft Json has similar functionality, and in Java — Jackson2 ObjectMapper.

The problem with this approach is that the people will have to build crutches like https://github.com/Randgalt/record-builder and by the time Java adds missing features all the codebases will be forever polluted with legacy workarounds that nobody will dare to remove because of backwards compatibility.

It also hinders adoption of new features as people will prefer to maintain consistency in their codebases.

Record builder is pretty good for making builders for your Java 17 records

I always have to bring up RecordBuilder simply because of the included Withers and it being a source generator instead of the Lombok weirdness.

The above is not particularly user-friendly. Luckily compiler plugins can provide the missing feature, most notably RecordBuilder:

For records, instead of lombok you can use https://github.com/Randgalt/record-builder which is a valid annotation processor and will not break on JDK changes

In this particular case you can generate the builder with something like https://github.com/Randgalt/record-builder that is both valid java and lombok-like enough

Records + Record Builder or immutables + the trick to hide the implementing class w/sealed are your friend. Both the mutability and naming conventions this generates are vomitus.

Did you use https://github.com/Randgalt/record-builder ?

Try my annotation processor. It generates withers. https://github.com/Randgalt/record-builder

I personally don't use that one much, but you could use this library instead.