Merge branch '2.9' into 2.10

Author: cowtowncoder

release-notes/VERSION-2.x

@@ -14,9 +14,13 @@ Project: jackson-databind
 #2060: `UnwrappingBeanPropertyWriter` incorrectly assumes the found serializer is
   of type `UnwrappingBeanSerializer`
  (reported by Petar T)
+#2079: NPE when visiting StaticListSerializerBase
+ (reported by WorldSEnder@github)
 #2082: `FactoryBasedEnumDeserializer` should be cachable
 #2096: `TreeTraversingParser` does not take base64 variant into account
  (reported by tangiel@github)
+#2097: Block more classes from polymorphic deserialization (CVE-2018-14718
+  - CVE-2018-14721)
 #2109: Canonical string for reference type is built incorrectly
  (reported by svarzee@github)
 
@@ -585,9 +589,10 @@ Project: jackson-databind
 #1225: `JsonMappingException` should override getProcessor()
  (reported by Nick B)
 
-2.6.8 (if ever released)
+2.6.7.1 (11-Jul-2017)
 
 #1383: Problem with `@JsonCreator` with 1-arg factory-method, implicit param names
+#1599: Backport the extra safety checks for polymorphic deserialization
 
 2.6.7 (05-Jun-2016)
 

src/main/java/com/fasterxml/jackson/databind/jsontype/impl/SubTypeValidator.java

@@ -68,6 +68,12 @@ public class SubTypeValidator
         s.add("oracle.jdbc.connector.OracleManagedConnectionFactory");
         s.add("oracle.jdbc.rowset.OracleJDBCRowSet");
 
+        // [databind#2097]: some 3rd party, one JDK-bundled
+        s.add("org.slf4j.ext.EventData");
+        s.add("flex.messaging.util.concurrent.AsynchBeansWorkManagerExecutor");
+        s.add("com.sun.deploy.security.ruleset.DRSHelper");
+        s.add("org.apache.axis2.jaxws.spi.handler.HandlerResolverImpl");
+
         DEFAULT_NO_DESER_CLASS_NAMES = Collections.unmodifiableSet(s);
     }
 

src/main/java/com/fasterxml/jackson/databind/ser/std/StaticListSerializerBase.java

@@ -110,7 +110,10 @@ public JsonNode getSchema(SerializerProvider provider, Type typeHint) {
 
     @Override
     public void acceptJsonFormatVisitor(JsonFormatVisitorWrapper visitor, JavaType typeHint) throws JsonMappingException {
-        acceptContentVisitor(visitor.expectArrayFormat(typeHint));
+        JsonArrayFormatVisitor v2 = visitor.expectArrayFormat(typeHint);
+        if (v2 != null) {
+            acceptContentVisitor(v2);
+        }
     }
 
     /*