#3551 Log warning for use of mapping column to Class (#3698)

I think it was a mistake for Ebean to support Class<?> from a security perspective. Instead, Ebean should just use a String <-> Varchar and leave if up to the application to take that String and convert it to a class [and then that potential Class initialisation is owned by the application code and all security considerations around that are owned by the application code].
This commit is contained in:
Rob Bygrave
2025-11-11 07:57:15 +13:00
committed by GitHub
parent d5547808a2
commit 5b04d6eca3
2 changed files with 4 additions and 1 deletions
@@ -216,6 +216,9 @@ public final class DefaultTypeManager implements TypeManager {
}
found = checkInheritedTypes(type);
}
if (found instanceof ScalarTypeClass) {
log.log(WARNING, "@Column mapping for type Class is deprecated. Please refer to https://ebean.io/docs/deprecated#class-mapping");
}
return found != ScalarTypeNotFound.INSTANCE ? found : null; // Do not return ScalarTypeNotFound, otherwise checks will fail
}
@@ -10,7 +10,7 @@ import jakarta.persistence.PersistenceException;
@SuppressWarnings({"rawtypes"})
final class ScalarTypeClass extends ScalarTypeBaseVarchar<Class> {
public ScalarTypeClass() {
ScalarTypeClass() {
super(Class.class);
}