From 5b04d6eca3131906f0fbb5086a438445360981fa Mon Sep 17 00:00:00 2001 From: Rob Bygrave Date: Tue, 11 Nov 2025 07:57:15 +1300 Subject: [PATCH] #3551 Log warning for use of mapping column to Class (#3698) I think it was a mistake for Ebean to support Class from a security perspective. Instead, Ebean should just use a String <-> Varchar and leave if up to the application to take that String and convert it to a class [and then that potential Class initialisation is owned by the application code and all security considerations around that are owned by the application code]. --- .../java/io/ebeaninternal/server/type/DefaultTypeManager.java | 3 +++ .../java/io/ebeaninternal/server/type/ScalarTypeClass.java | 2 +- 2 files changed, 4 insertions(+), 1 deletion(-) diff --git a/ebean-core/src/main/java/io/ebeaninternal/server/type/DefaultTypeManager.java b/ebean-core/src/main/java/io/ebeaninternal/server/type/DefaultTypeManager.java index 25eb11ca2..225029e7a 100644 --- a/ebean-core/src/main/java/io/ebeaninternal/server/type/DefaultTypeManager.java +++ b/ebean-core/src/main/java/io/ebeaninternal/server/type/DefaultTypeManager.java @@ -216,6 +216,9 @@ public final class DefaultTypeManager implements TypeManager { } found = checkInheritedTypes(type); } + if (found instanceof ScalarTypeClass) { + log.log(WARNING, "@Column mapping for type Class is deprecated. Please refer to https://ebean.io/docs/deprecated#class-mapping"); + } return found != ScalarTypeNotFound.INSTANCE ? found : null; // Do not return ScalarTypeNotFound, otherwise checks will fail } diff --git a/ebean-core/src/main/java/io/ebeaninternal/server/type/ScalarTypeClass.java b/ebean-core/src/main/java/io/ebeaninternal/server/type/ScalarTypeClass.java index 2e636fd4a..da6689284 100644 --- a/ebean-core/src/main/java/io/ebeaninternal/server/type/ScalarTypeClass.java +++ b/ebean-core/src/main/java/io/ebeaninternal/server/type/ScalarTypeClass.java @@ -10,7 +10,7 @@ import jakarta.persistence.PersistenceException; @SuppressWarnings({"rawtypes"}) final class ScalarTypeClass extends ScalarTypeBaseVarchar { - public ScalarTypeClass() { + ScalarTypeClass() { super(Class.class); }