More polymorphism TCKs added (#300)

- More polymorphism TCKs added
- minor change in secure class deserialization

Signed-off-by: David Kral <david.k.kral@oracle.com>

Author: Verdent

api/src/main/java/jakarta/json/bind/annotation/JsonbPolymorphicType.java

@@ -27,28 +27,32 @@
  * This annotation is required on the most common parent of all classes when polymorphism will be applied.
  * <pre><code>
  * // Example
- * {@literal @}JsonbPolymorphicType(keyName = "@key")
+ * {@literal @}JsonbPolymorphicType(key = "@key")
  * interface Animal {}
  *
  * class Dog implements Animal {}
  * class Cat implements Animal {}
  * </code></pre>
  * This annotation is tightly bound to {@link JsonbSubtype}. It is recommended to use
  * {@link JsonbSubtype} annotations to specify all the possible classes and their aliases.
- * <br>
  */
 @JsonbAnnotation
 @Retention(RetentionPolicy.RUNTIME)
 @Target({ElementType.ANNOTATION_TYPE, ElementType.TYPE})
 public @interface JsonbPolymorphicType {
 
+    /**
+     * Default polymorphic information key name.
+     */
+    String DEFAULT_KEY_NAME = "@type";
+
     /**
      * Key used for keeping polymorphic information when {@link Format#PROPERTY} is chosen.
      * Default value is {@code @type}.
      *
      * @return key name
      */
-    String key() default "";
+    String key() default DEFAULT_KEY_NAME;
 
     /**
      * Specification of how the polymorphic information will be stored in the resulting JSON.
@@ -70,12 +74,10 @@
      * Allowed package names. This option is ignored if {@link JsonbPolymorphicType#classNames()}
      * option is set to false.
      * <br>
-     * Only classes contained in the selected packages will be serialized/deserialized.
+     * Only classes contained in the selected packages will be deserialized.
      * Classes with specified alias are not validated.
      * <br>
-     * It is strongly recommended that you set up allowed packages when classes without aliases will be processed.
-     * <br>
-     * When no package is specified, all classes without aliases are allowed.
+     * It is required to have allowed packages set up when classes without aliases will be processed.
      *
      * @return list of allowed packages
      */

spec/src/main/asciidoc/jsonb.adoc

@@ -320,7 +320,7 @@ Deserialization into anonymous classes is not supported. Serialization of anonym
 
 Polymorphic type handling is supported for deserialization and serialization. Polymorphic handling is ensured by annotation `@JsonbPolymorphicType` and `@JsonbSubtype`. `@JsonbPolymorphicType` defines how the overall polymorphic information strategy will be serialized/deserialized and defines all the supported aliases using `@JsonbSubtype` annotations. `@JsonbSubtype` ensures proper and safe mapping between class alias and type. Implementation must validate mapped types if they are assignable from the annotated type. If not, an exception must be thrown.
 
-Polymorphic information is obtained from `@JsonbSubtype` annotation as a type alias mapped to the type or if `classNames` property of the `@JsonbPolymorphicType` is enabled, it corresponds to the fully qualified class name, if no suitable alias is found. Implementation must ensure to support `allowedPackages` option of the `@JsonbPolymorphicType` which is only used when `classNames` option is enabled, it is ignored otherwise. It is not allowed to create instances of the classes outside the allowed packages. In such cases an exception must be thrown. If allowed packages are empty, all classes are allowed.
+Polymorphic information is obtained from `@JsonbSubtype` annotation as a type alias mapped to the type or if `classNames` property of the `@JsonbPolymorphicType` is enabled, it corresponds to the fully qualified class name, if no suitable alias is found. Implementation must ensure to support `allowedPackages` option of the `@JsonbPolymorphicType` which is only used when `classNames` option is enabled, it is ignored otherwise. It is not allowed to create instances of the classes outside the allowed packages. In such cases an exception must be thrown. It is also required to have `allowedPackages` option set if `classNames` option is enabled. If the `allowedPackages` is null or empty an exception must be thrown.
 
 Available serialization formats:
 

tck/src/main/java/jakarta/json/bind/tck/defaultmapping/polymorphictypes/AnnotationPolymorphismObjectTest.java

@@ -35,6 +35,12 @@
 import org.junit.Test;
 import org.junit.runner.RunWith;
 
+import static jakarta.json.bind.tck.RegexMatcher.matches;
+
+import static org.hamcrest.CoreMatchers.instanceOf;
+import static org.hamcrest.CoreMatchers.is;
+import static org.hamcrest.MatcherAssert.assertThat;
+import static org.junit.Assert.assertThrows;
 import static org.junit.Assert.fail;
 
 /**
@@ -153,6 +159,32 @@ public void testArrayDeserialization() {
         }
     }
 
+    @Test
+    public void testSerializationClassNamesWithCorrectAllowedPackages() {
+        String expected = "\\{\\s*\"jakarta.json.bind.tck.defaultmapping.polymorphictypes."
+                + "AnnotationPolymorphismObjectTest\\$ChildClassNamesWithCorrectAllowed\"\\s*:\\s*\\"
+                + "{\\s*\"parent\"\\s*:\\s*1\\s*,"
+                + "\\s*\"child\"\\s*:\\s*2\\s*\\}\\}";
+        assertThat(jsonb.toJson(new ChildClassNamesWithCorrectAllowed()), matches(expected));
+    }
+
+    @Test
+    public void testDeserializationClassNamesWithCorrectAllowedPackages() {
+        String json = "{\"jakarta.json.bind.tck.defaultmapping.polymorphictypes."
+                + "AnnotationPolymorphismObjectTest$ChildClassNamesWithCorrectAllowed\":{\"parent\":3,\"child\":4}}";
+        ParentClassNamesWithCorrectAllowed deserialized = jsonb.fromJson(json, ParentClassNamesWithCorrectAllowed.class);
+        assertThat(deserialized, instanceOf(ChildClassNamesWithCorrectAllowed.class));
+        assertThat(deserialized.parent, is(3));
+        assertThat(((ChildClassNamesWithCorrectAllowed)deserialized).child, is(4));
+    }
+
+    @Test
+    public void testDeserializationClassNamesWithIncorrectAllowedPackages() {
+        String json = "{\"jakarta.json.bind.tck.defaultmapping.polymorphictypes."
+                + "AnnotationPolymorphismObjectTest$ChildClassNamesWithIncorrectAllowed\":{\"parent\":1,\"child\":2}}";
+        assertThrows(JsonbException.class, () -> jsonb.fromJson(json, ParentClassNamesWithIncorrectAllowed.class));
+    }
+
     @JsonbPolymorphicType(format = JsonbPolymorphicType.Format.WRAPPING_OBJECT, value = {
             @JsonbSubtype(alias = "dog", type = Dog.class),
             @JsonbSubtype(alias = "cat", type = Cat.class)
@@ -197,4 +229,24 @@ public DateConstructor(@JsonbProperty("localDate") @JsonbDateFormat(value = "dd-
 
     }
 
+    @JsonbPolymorphicType(format = JsonbPolymorphicType.Format.WRAPPING_OBJECT,
+                          classNames = true, allowedPackages = {"jakarta.json.bind.tck.defaultmapping.polymorphictypes"})
+    public static class ParentClassNamesWithCorrectAllowed {
+        public int parent = 1;
+    }
+
+    public static class ChildClassNamesWithCorrectAllowed extends ParentClassNamesWithCorrectAllowed {
+        public int child = 2;
+    }
+
+    @JsonbPolymorphicType(format = JsonbPolymorphicType.Format.WRAPPING_OBJECT,
+                          classNames = true, allowedPackages = {"jakarta.jsonb.incorrect"})
+    public static class ParentClassNamesWithIncorrectAllowed {
+        public int parent = 1;
+    }
+
+    public static class ChildClassNamesWithIncorrectAllowed extends ParentClassNamesWithIncorrectAllowed {
+        public int child = 2;
+    }
+
 }

tck/src/main/java/jakarta/json/bind/tck/defaultmapping/polymorphictypes/AnnotationPolymorphismTest.java

@@ -16,13 +16,9 @@
 
 package jakarta.json.bind.tck.defaultmapping.polymorphictypes;
 
-import java.io.ByteArrayInputStream;
 import java.lang.invoke.MethodHandles;
-import java.nio.charset.StandardCharsets;
 import java.time.LocalDate;
 
-import jakarta.json.Json;
-import jakarta.json.JsonObject;
 import jakarta.json.bind.Jsonb;
 import jakarta.json.bind.JsonbBuilder;
 import jakarta.json.bind.JsonbException;
@@ -39,6 +35,12 @@
 import org.junit.Test;
 import org.junit.runner.RunWith;
 
+import static jakarta.json.bind.tck.RegexMatcher.matches;
+
+import static org.hamcrest.CoreMatchers.instanceOf;
+import static org.hamcrest.CoreMatchers.is;
+import static org.hamcrest.MatcherAssert.assertThat;
+import static org.junit.Assert.assertThrows;
 import static org.junit.Assert.fail;
 
 /**
@@ -59,8 +61,6 @@ public static WebArchive createTestArchive() {
     public void testBasicSerialization() {
         Dog dog = new Dog();
         String jsonString = jsonb.toJson(dog);
-        JsonObject object = Json.createParser(new ByteArrayInputStream(jsonString.getBytes(StandardCharsets.UTF_8))).getObject();
-
         if (!jsonString.matches("\\{\\s*\"@type\"\\s*:\\s*\"dog\"\\s*,\\s*\"isDog\"\\s*:\\s*true\\s*\\}")) {
             fail("Failed to serialize Dog class correctly in the polymorphic format: "
                          + JsonbPolymorphicType.Format.PROPERTY.name());
@@ -160,6 +160,32 @@ public void testArrayDeserialization() {
         }
     }
 
+    @Test
+    public void testSerializationClassNamesWithCorrectAllowedPackages() {
+        String expected = "\\{\\s*\"@type\"\\s*:\\s*\"jakarta.json.bind.tck.defaultmapping.polymorphictypes"
+                + ".AnnotationPolymorphismTest\\$ChildClassNamesWithCorrectAllowed\"\\s*,"
+                + "\\s*\"parent\"\\s*:\\s*1\\s*,"
+                + "\\s*\"child\"\\s*:\\s*2\\s*\\}";
+        assertThat(jsonb.toJson(new ChildClassNamesWithCorrectAllowed()), matches(expected));
+    }
+
+    @Test
+    public void testDeserializationClassNamesWithCorrectAllowedPackages() {
+        String json = "{\"@type\":\"jakarta.json.bind.tck.defaultmapping.polymorphictypes"
+                + ".AnnotationPolymorphismTest$ChildClassNamesWithCorrectAllowed\",\"parent\":3,\"child\":4}";
+        ParentClassNamesWithCorrectAllowed deserialized = jsonb.fromJson(json, ParentClassNamesWithCorrectAllowed.class);
+        assertThat(deserialized, instanceOf(ChildClassNamesWithCorrectAllowed.class));
+        assertThat(deserialized.parent, is(3));
+        assertThat(((ChildClassNamesWithCorrectAllowed)deserialized).child, is(4));
+    }
+
+    @Test
+    public void testDeserializationClassNamesWithIncorrectAllowedPackages() {
+        String json = "{\"@type\":\"jakarta.json.bind.tck.defaultmapping.polymorphictypes."
+                + "AnnotationPolymorphismTest$ChildClassNamesWithIncorrectAllowed\",\"parent\":1,\"child\":2}";
+        assertThrows(JsonbException.class, () -> jsonb.fromJson(json, ParentClassNamesWithIncorrectAllowed.class));
+    }
+
     @JsonbPolymorphicType({
             @JsonbSubtype(alias = "dog", type = Dog.class),
             @JsonbSubtype(alias = "cat", type = Cat.class),
@@ -212,4 +238,22 @@ public DateConstructor(@JsonbProperty("localDate") @JsonbDateFormat(value = "dd-
 
     }
 
+    @JsonbPolymorphicType(classNames = true, allowedPackages = {"jakarta.json.bind.tck.defaultmapping.polymorphictypes"})
+    public static class ParentClassNamesWithCorrectAllowed {
+        public int parent = 1;
+    }
+
+    public static class ChildClassNamesWithCorrectAllowed extends ParentClassNamesWithCorrectAllowed {
+        public int child = 2;
+    }
+
+    @JsonbPolymorphicType(classNames = true, allowedPackages = {"jakarta.jsonb.incorrect"})
+    public static class ParentClassNamesWithIncorrectAllowed {
+        public int parent = 1;
+    }
+
+    public static class ChildClassNamesWithIncorrectAllowed extends ParentClassNamesWithIncorrectAllowed {
+        public int child = 2;
+    }
+
 }

tck/src/main/java/jakarta/json/bind/tck/defaultmapping/polymorphictypes/MultiplePolymorphicInfoObjectTest.java

@@ -0,0 +1,129 @@
+/*
+ * Copyright (c) 2021 Oracle and/or its affiliates. All rights reserved.
+ *
+ * This program and the accompanying materials are made available under the
+ * terms of the Eclipse Public License v. 2.0, which is available at
+ * http://www.eclipse.org/legal/epl-2.0.
+ *
+ * This Source Code may also be made available under the following Secondary
+ * Licenses when the conditions for such availability set forth in the
+ * Eclipse Public License v. 2.0 are satisfied: GNU General Public License,
+ * version 2 with the GNU Classpath Exception, which is available at
+ * https://www.gnu.org/software/classpath/license.html.
+ *
+ * SPDX-License-Identifier: EPL-2.0 OR GPL-2.0 WITH Classpath-exception-2.0
+ */
+
+package jakarta.json.bind.tck.defaultmapping.polymorphictypes;
+
+import java.lang.invoke.MethodHandles;
+
+import jakarta.json.bind.Jsonb;
+import jakarta.json.bind.JsonbBuilder;
+import jakarta.json.bind.annotation.JsonbPolymorphicType;
+import jakarta.json.bind.annotation.JsonbSubtype;
+
+import org.jboss.arquillian.container.test.api.Deployment;
+import org.jboss.arquillian.junit.Arquillian;
+import org.jboss.shrinkwrap.api.ShrinkWrap;
+import org.jboss.shrinkwrap.api.spec.WebArchive;
+import org.junit.Test;
+import org.junit.runner.RunWith;
+
+import static jakarta.json.bind.tck.RegexMatcher.matches;
+
+import static org.hamcrest.CoreMatchers.instanceOf;
+import static org.hamcrest.MatcherAssert.assertThat;
+
+@RunWith(Arquillian.class)
+public class MultiplePolymorphicInfoObjectTest {
+
+    private static final Jsonb JSONB = JsonbBuilder.create();
+
+    @Deployment
+    public static WebArchive createTestArchive() {
+        return ShrinkWrap.create(WebArchive.class)
+                .addPackages(true, MethodHandles.lookup().lookupClass().getPackage().getName());
+    }
+
+    @Test
+    public void testMultiplePolymorphicInfoObjectSerialization() {
+        String expected = "\\{\\s*\"animal\"\\s*:\\s*"
+                + "\\{\\s*\"dog\"\\s*:\\s*"
+                + "\\{\\s*\"labrador\"\\s*:\\s*"
+                + "\\{\\s*\"isLabrador\"\\s*:\\s*true\\s*\\}"
+                + "\\}\\}\\}";
+        Labrador labrador = new Labrador();
+        assertThat(JSONB.toJson(labrador), matches(expected));
+    }
+
+    @Test
+    public void testMultiplePolymorphicInfoObjectDeserialization() {
+        String json = "{\"animal\":{\"dog\":{\"labrador\":{\"isLabrador\":true}}}}";
+        assertThat(JSONB.fromJson(json, Labrador.class), instanceOf(Labrador.class));
+    }
+
+    @Test
+    public void testSerializeMultiplePolyTypesInSingleChain() {
+        String expected =  "\\{\\s*\"vehicle\"\\s*:\\s*"
+                + "\\{\\s*\"car\"\\s*:\\s*"
+                + "\\{"
+                + "\\s*\"machineProperty\"\\s*:\\s*\"machineProperty\"\\s*,"
+                + "\\s*\"vehicleProperty\"\\s*:\\s*\"vehicleProperty\"\\s*,"
+                + "\\s*\"carProperty\"\\s*:\\s*\"carProperty\"\\s*"
+                + "\\}\\}\\}";
+        Car car = new Car();
+        assertThat(JSONB.toJson(car), matches(expected));
+    }
+
+    @Test
+    public void testDeserializeMultiplePolyTypesInSingleChain() {
+        String json = "{\"vehicle\":{\"car\":{"
+                + "\"machineProperty\":\"machineProperty\","
+                + "\"vehicleProperty\":\"vehicleProperty\","
+                + "\"carProperty\":\"carProperty\""
+                + "}}}";
+        Machine machine = JSONB.fromJson(json, Machine.class);
+        assertThat(machine, instanceOf(Car.class));
+    }
+
+    @JsonbPolymorphicType(format = JsonbPolymorphicType.Format.WRAPPING_OBJECT, value = {
+            @JsonbSubtype(alias = "animal", type = Animal.class)
+    })
+    public interface livingThing { }
+
+    @JsonbPolymorphicType(format = JsonbPolymorphicType.Format.WRAPPING_OBJECT, value = {
+            @JsonbSubtype(alias = "dog", type = Dog.class)
+    })
+    public interface Animal extends livingThing { }
+
+    @JsonbPolymorphicType(format = JsonbPolymorphicType.Format.WRAPPING_OBJECT, value = {
+            @JsonbSubtype(alias = "labrador", type = Labrador.class)
+    })
+    public interface Dog extends Animal { }
+
+    public static class Labrador implements Dog {
+
+        public boolean isLabrador = true;
+
+    }
+
+    @JsonbPolymorphicType(format = JsonbPolymorphicType.Format.WRAPPING_OBJECT, value = {
+            @JsonbSubtype(alias = "vehicle", type = Vehicle.class)
+    })
+    public static class Machine {
+        public String machineProperty = "machineProperty";
+    }
+
+    @JsonbPolymorphicType(format = JsonbPolymorphicType.Format.WRAPPING_OBJECT, value = {
+            @JsonbSubtype(alias = "car", type = Car.class)
+    })
+    public static class Vehicle extends Machine {
+        public String vehicleProperty = "vehicleProperty";
+    }
+
+    public static class Car extends Vehicle {
+        public String carProperty = "carProperty";
+    }
+
+}