Weird behaviour with polymorphic deserealization

[raindel]

Hey everybody.

I have a Jira plugin which uses Jackson to serialize/deserialize it's configuration.

The code itself looks like this (simplified):

public interface ConditionBean {}
public record RuleBean(@JsonProperty("condition") ConditionBean condition) {}
public record RestrictionBean(@JsonProperty("rules") List<RuleBean> rules) {}

The ConditionBean interface has a number of concrete implementations. I'm trying to add @JsonTypeInfo to handle this, and here's it get's weird.

If I do it like this, everything works fine:

@JsonTypeInfo(use = JsonTypeInfo.Id.NAME, include = JsonTypeInfo.As.PROPERTY, property = "type")
@JsonSubTypes({ @JsonSubTypes.Type(value = FirstConditionBean.class, name = "FirstConditionBean"),
                @JsonSubTypes.Type(value = SecondConditionBean.class, name = "SecondConditionBean") })
public interface ConditionBean {}

The owning object is serialized as:

{"id":1, "condition":{"type":"FirstConditionBean"}

Then I tried to make this less wordy and tried this:

@JsonTypeInfo(use = JsonTypeInfo.Id.CLASS, include = JsonTypeInfo.As.PROPERTY, property = "type")
@JsonSubTypes({ @JsonSubTypes.Type(value = FirstConditionBean.class),
                @JsonSubTypes.Type(value = SecondConditionBean.class) })
public interface ConditionBean {}

Resulting JSON is like this which seems fine:

{"id":1, "condition":{"type":"com.my.org.FirstConditionBean"}

However, when I try deserialize this when the plugin starts, I get an error:
Caused by: com.fasterxml.jackson.databind.exc.InvalidTypeIdException: Could not resolve type id 'com.my.org.FirstConditionBean' as a subtype of com.my.org.ConditionBean: no such class found

What puzzles me more is that it only happens right after start. If I execute exactly the same code later, everything works. As if something wasn't loaded at the beginning.

Am I missing something?

[pjfanning]

Can you provide a full reproducer?
Also JsonTypeInfo.Id.CLASS is dangerous, especially if have any possibility of getting untrusted input. I would recommend JsonTypeInfo.Id.NAME.

[raindel]

I can try, but the problem is, I wasn't able to reproduce it in other circumstances, i.e. I only see it on Jira plugin startup. I can try to prepare a simple Jira plugin to see this, but the chances are you'd have to install it to a Jira Datacenter instance to see this :)
Is this something worth pursuing?

I'm good with dropping this, as JsonTypeInfo.Id.NAME works just fine.

[cowtowncoder]

Ok that does sound troubling. Usage looks valid (with caveats wrt security that @pjfanning mentioned).

But unfortunately without reproduction it is not possible to do much -- I cannot think of what could go wrong from Jackson side.

So will close for now: may be re-opened with reproduction.