Fix #1899

FasterXML · Jan 22, 2018 · 038b471 · 038b471
1 parent b744bf3
commit 038b471
Show file tree

Hide file tree

Showing 2 changed files with 7 additions and 1 deletion.
diff --git a/release-notes/VERSION b/release-notes/VERSION
@@ -5,9 +5,11 @@ Project: jackson-databind
 
 2.8.11.1 (not yet released)
 
-#1872 `NullPointerException` in `SubTypeValidator.validateSubType` when
+#1872: `NullPointerException` in `SubTypeValidator.validateSubType` when
   validating Spring interface
  (reported by Rob W)
+#1899: Another two gadgets to exploit default typing issue in jackson-databind
+ (reported by OneSourceCat@github)
 
 2.8.11 (24-Dec-2017)
 

diff --git a/src/main/java/com/fasterxml/jackson/databind/jsontype/impl/SubTypeValidator.java b/src/main/java/com/fasterxml/jackson/databind/jsontype/impl/SubTypeValidator.java
@@ -50,6 +50,10 @@ public class SubTypeValidator
         // [databind#1855]: more 3rd party
         s.add("org.apache.tomcat.dbcp.dbcp2.BasicDataSource");
         s.add("com.sun.org.apache.bcel.internal.util.ClassLoader");
+        // [databind#1899]: more 3rd party
+        s.add("org.hibernate.jmx.StatisticsService");
+        s.add("org.apache.ibatis.datasource.jndi.JndiDataSourceFactory");
+
         DEFAULT_NO_DESER_CLASS_NAMES = Collections.unmodifiableSet(s);
     }