mirror of
https://github.com/ebean-orm/ebean.git
synced 2026-09-20 03:16:42 +00:00
I think it was a mistake for Ebean to support Class<?> from a security perspective. Instead, Ebean should just use a String <-> Varchar and leave if up to the application to take that String and convert it to a class [and then that potential Class initialisation is owned by the application code and all security considerations around that are owned by the application code].
This commit is contained in:
@@ -216,6 +216,9 @@ public final class DefaultTypeManager implements TypeManager {
|
||||
}
|
||||
found = checkInheritedTypes(type);
|
||||
}
|
||||
if (found instanceof ScalarTypeClass) {
|
||||
log.log(WARNING, "@Column mapping for type Class is deprecated. Please refer to https://ebean.io/docs/deprecated#class-mapping");
|
||||
}
|
||||
return found != ScalarTypeNotFound.INSTANCE ? found : null; // Do not return ScalarTypeNotFound, otherwise checks will fail
|
||||
}
|
||||
|
||||
|
||||
@@ -10,7 +10,7 @@ import jakarta.persistence.PersistenceException;
|
||||
@SuppressWarnings({"rawtypes"})
|
||||
final class ScalarTypeClass extends ScalarTypeBaseVarchar<Class> {
|
||||
|
||||
public ScalarTypeClass() {
|
||||
ScalarTypeClass() {
|
||||
super(Class.class);
|
||||
}
|
||||
|
||||
|
||||
Reference in New Issue
Block a user