Add DeserializationFeature.FAIL_ON_SUBTYPE_CLASS_NOT_REGISTERED

src/main/java/com/fasterxml/jackson/databind/DeserializationFeature.java

@@ -253,7 +253,7 @@ public enum DeserializationFeature implements ConfigFeature
     FAIL_ON_MISSING_EXTERNAL_TYPE_ID_PROPERTY(true),
 
     /**
-     * Feature that determines behaviour for data-binding after binding the root value.
+     * Feature that determines behavior for data-binding after binding the root value.
      * If feature is enabled, one more call to
      * {@link com.fasterxml.jackson.core.JsonParser#nextToken} is made to ensure that
      * no more tokens are found (and if any is found,
@@ -272,6 +272,19 @@ public enum DeserializationFeature implements ConfigFeature
      */
     FAIL_ON_TRAILING_TOKENS(false),
 
+    /**
+     * Feature that determines behavior when deserializing polymorphic types of
+     * Id.CLASS or Id.MINIMAL_CLASS type if the subtype is not explicitly registered.
+     * For types like Id.NAME, you already need to declare the subtypes but with
+     * Id.CLASS and Id.MINIMAL_CLASS you do not. If enabled, an exception will be
+     * thrown if a subtype is encountered that has not been explicitly registered.
+     *<p>
+     * Feature is disabled by default.
+     *
+     * @since 2.19
+     */
+    FAIL_ON_POLYMORPHIC_SUBTYPE_CLASS_NOT_EXPLICITLY_REGISTERED(false),
+
     /**
      * Feature that determines whether Jackson code should catch
      * and wrap {@link Exception}s (but never {@link Error}s!)

src/main/java/com/fasterxml/jackson/databind/jsontype/impl/ClassNameIdResolver.java

@@ -7,6 +7,7 @@
 
 import com.fasterxml.jackson.databind.*;
 import com.fasterxml.jackson.databind.cfg.MapperConfig;
+import com.fasterxml.jackson.databind.jsontype.NamedType;
 import com.fasterxml.jackson.databind.jsontype.PolymorphicTypeValidator;
 import com.fasterxml.jackson.databind.type.TypeFactory;
 import com.fasterxml.jackson.databind.util.ClassUtil;
@@ -26,6 +27,8 @@ public class ClassNameIdResolver
 
     protected final PolymorphicTypeValidator _subTypeValidator;
 
+    private Set<String> _allowedSubtypes;
+
     /**
      * @deprecated Since 2.10 use variant that takes {@link PolymorphicTypeValidator}
      */
@@ -36,18 +39,48 @@ protected ClassNameIdResolver(JavaType baseType, TypeFactory typeFactory) {
 
     /**
      * @since 2.10
+     * @deprecated Since 2.19 use variant that takes {@link Collection<NamedType>}
      */
     public ClassNameIdResolver(JavaType baseType, TypeFactory typeFactory,
             PolymorphicTypeValidator ptv) {
+        this(baseType, typeFactory, null, ptv);
+    }
+
+    /**
+     * @since 2.19
+     */
+    public ClassNameIdResolver(JavaType baseType, TypeFactory typeFactory,
+                               Collection<NamedType> subtypes, PolymorphicTypeValidator ptv) {
         super(baseType, typeFactory);
         _subTypeValidator = ptv;
+        if (subtypes != null) {
+            for (NamedType t : subtypes) {
+                final Class<?> cls = t.getType();
+                if (_allowedSubtypes == null) {
+                    _allowedSubtypes = new HashSet<>();
+                }
+                _allowedSubtypes.add(cls.getName());
+            }
+        }
     }
 
-    public static ClassNameIdResolver construct(JavaType baseType, MapperConfig<?> config,
-            PolymorphicTypeValidator ptv) {
+    /**
+     * @deprecated since 2.19
+     */
+    public static ClassNameIdResolver construct(JavaType baseType,
+            MapperConfig<?> config, PolymorphicTypeValidator ptv) {
         return new ClassNameIdResolver(baseType, config.getTypeFactory(), ptv);
     }
 
+    /**
+     * @since 2.19
+     */
+    public static ClassNameIdResolver construct(JavaType baseType, MapperConfig<?> config,
+                                                Collection<NamedType> subtypes,
+                                                PolymorphicTypeValidator ptv) {
+        return new ClassNameIdResolver(baseType, config.getTypeFactory(), subtypes, ptv);
+    }
+
     @Override
     public JsonTypeInfo.Id getMechanism() { return JsonTypeInfo.Id.CLASS; }
 
@@ -72,14 +105,21 @@ public JavaType typeFromId(DatabindContext context, String id) throws IOExceptio
 
     protected JavaType _typeFromId(String id, DatabindContext ctxt) throws IOException
     {
-        // 24-Apr-2019, tatu: [databind#2195] validate as well as resolve:
-        JavaType t = ctxt.resolveAndValidateSubType(_baseType, id, _subTypeValidator);
-        if (t == null) {
-            if (ctxt instanceof DeserializationContext) {
-                // First: we may have problem handlers that can deal with it?
-                return ((DeserializationContext) ctxt).handleUnknownTypeId(_baseType, id, this, "no such class found");
+        DeserializationContext deserializationContext = null;
+        if (ctxt instanceof DeserializationContext) {
+            deserializationContext = (DeserializationContext) ctxt;
+        }
+        if (_allowedSubtypes != null && deserializationContext != null
+                && deserializationContext.isEnabled(
+                        DeserializationFeature.FAIL_ON_POLYMORPHIC_SUBTYPE_CLASS_NOT_EXPLICITLY_REGISTERED)) {
+            if (!_allowedSubtypes.contains(id)) {
+                throw deserializationContext.invalidTypeIdException(_baseType, id,
+                        "DeserializationFeature.FAIL_ON_POLYMORPHIC_SUBTYPE_CLASS_NOT_EXPLICITLY_REGISTERED is explicitly enabled and the input class is not registered using JsonSubTypes annotation.");
             }
-            // ... meaning that we really should never get here.
+        }
+        final JavaType t = ctxt.resolveAndValidateSubType(_baseType, id, _subTypeValidator);
+        if (t == null && deserializationContext != null) {
+            return deserializationContext.handleUnknownTypeId(_baseType, id, this, "no such class found");
         }
         return t;
     }

src/main/java/com/fasterxml/jackson/databind/jsontype/impl/MinimalClassNameIdResolver.java

@@ -1,12 +1,14 @@
 package com.fasterxml.jackson.databind.jsontype.impl;
 
 import java.io.IOException;
+import java.util.Collection;
 
 import com.fasterxml.jackson.annotation.JsonTypeInfo;
 
 import com.fasterxml.jackson.databind.DatabindContext;
 import com.fasterxml.jackson.databind.JavaType;
 import com.fasterxml.jackson.databind.cfg.MapperConfig;
+import com.fasterxml.jackson.databind.jsontype.NamedType;
 import com.fasterxml.jackson.databind.jsontype.PolymorphicTypeValidator;
 import com.fasterxml.jackson.databind.type.TypeFactory;
 
@@ -32,8 +34,21 @@ public class MinimalClassNameIdResolver
      */
     protected final String _basePackagePrefix;
 
+    /**
+     * @deprecated since 2.19
+     */
     protected MinimalClassNameIdResolver(JavaType baseType, TypeFactory typeFactory,
             PolymorphicTypeValidator ptv)
+    {
+        this(baseType, typeFactory, null, ptv);
+    }
+
+    /**
+     * @since 2.19
+     */
+    protected MinimalClassNameIdResolver(JavaType baseType, TypeFactory typeFactory,
+                                         Collection<NamedType> subtypes,
+                                         PolymorphicTypeValidator ptv)
     {
         super(baseType, typeFactory, ptv);
         String base = baseType.getRawClass().getName();
@@ -47,11 +62,23 @@ protected MinimalClassNameIdResolver(JavaType baseType, TypeFactory typeFactory,
         }
     }
 
+    /**
+     * @deprecated since 2.19
+     */
     public static MinimalClassNameIdResolver construct(JavaType baseType, MapperConfig<?> config,
-            PolymorphicTypeValidator ptv) {
+                                                       PolymorphicTypeValidator ptv) {
         return new MinimalClassNameIdResolver(baseType, config.getTypeFactory(), ptv);
     }
 
+    /**
+     * @since 2.19
+     */
+    public static MinimalClassNameIdResolver construct(JavaType baseType, MapperConfig<?> config,
+                                                       Collection<NamedType> subtypes,
+                                                       PolymorphicTypeValidator ptv) {
+        return new MinimalClassNameIdResolver(baseType, config.getTypeFactory(), subtypes, ptv);
+    }
+
     @Override
     public JsonTypeInfo.Id getMechanism() { return JsonTypeInfo.Id.MINIMAL_CLASS; }
 

src/main/java/com/fasterxml/jackson/databind/jsontype/impl/StdTypeResolverBuilder.java

@@ -356,9 +356,9 @@ protected TypeIdResolver idResolver(MapperConfig<?> config,
         switch (_idType) {
         case DEDUCTION: // Deduction produces class names to be resolved
         case CLASS:
-            return ClassNameIdResolver.construct(baseType, config, subtypeValidator);
+            return ClassNameIdResolver.construct(baseType, config, subtypes, subtypeValidator);
         case MINIMAL_CLASS:
-            return MinimalClassNameIdResolver.construct(baseType, config, subtypeValidator);
+            return MinimalClassNameIdResolver.construct(baseType, config, subtypes, subtypeValidator);
         case SIMPLE_NAME:
             return SimpleNameIdResolver.construct(config, baseType, subtypes, forSer, forDeser);
         case NAME:

src/test/java/com/fasterxml/jackson/databind/deser/PolymorphicIdClassDeserTest.java

@@ -0,0 +1,43 @@
+package com.fasterxml.jackson.databind.deser;
+
+import com.fasterxml.jackson.annotation.JsonSubTypes;
+import com.fasterxml.jackson.annotation.JsonTypeInfo;
+import com.fasterxml.jackson.databind.DeserializationFeature;
+import com.fasterxml.jackson.databind.ObjectMapper;
+import com.fasterxml.jackson.databind.exc.InvalidTypeIdException;
+import com.fasterxml.jackson.databind.testutil.DatabindTestUtil;
+import org.junit.jupiter.api.Test;
+
+import static org.junit.jupiter.api.Assertions.assertThrows;
+import static org.junit.jupiter.api.Assertions.assertTrue;
+
+public class PolymorphicIdClassDeserTest extends DatabindTestUtil {
+
+    @JsonTypeInfo(use = JsonTypeInfo.Id.CLASS)
+    @JsonSubTypes({@JsonSubTypes.Type(value = FooClassImpl.class)})
+    static abstract class FooClass { }
+    static class FooClassImpl extends FooClass { }
+    static class FooClassImpl2 extends FooClass { }
+
+    /*
+    /************************************************************
+    /* Unit tests, valid
+    /************************************************************
+    */
+
+    private final ObjectMapper MAPPER = jsonMapperBuilder()
+            .enable(DeserializationFeature.FAIL_ON_POLYMORPHIC_SUBTYPE_CLASS_NOT_EXPLICITLY_REGISTERED)
+            .build();
+
+    @Test
+    public void testDeserialization() throws Exception
+    {
+        //trying to test if JsonSubTypes enforced
+        final String foo1 = MAPPER.writeValueAsString(new FooClassImpl());
+        final String foo2 = MAPPER.writeValueAsString(new FooClassImpl2());
+        FooClass res1 = MAPPER.readValue(foo1, FooClass.class);
+        assertTrue(res1 instanceof FooClassImpl);
+        // next bit should in theory fail because FooClassImpl2 is not listed as a subtype
+        assertThrows(InvalidTypeIdException.class, () -> MAPPER.readValue(foo2, FooClass.class));
+    }
+}