Security

The Apache Software Foundation takes an active stance in eliminating security problems and denial-of-service attacks against Apache projects.

Reporting a vulnerability

Report undisclosed security vulnerabilities to the private security mailing list first, before disclosing them in a public forum:

security (at) apache (dot) org. See the ASF security process.

The security list is only for reporting undisclosed vulnerabilities and coordinating their fixes. Regular bug reports belong in the issue tracker; anything else sent to the security address will be ignored.

Questions about configuring Johnzon securely, whether a vulnerability applies to your application, details on a published vulnerability, or the availability of patches belong on the mailing list.

Hardening notes

BigInteger and BigDecimal

JSON-P and JSON-B expose APIs using BigDecimal and BigInteger. The bridge between the two, BigDecimal#toBigInteger, is slow in Java when used without care or scale validation.

Johnzon runs sanity checks on these values, but past a certain point we recommend staying away from those APIs for very large numbers: handle them as String and parse them yourself, applying the scale validation only you know is functionally correct before instantiation. If you don’t need arbitrarily large types, prefer plain primitives or their wrappers.

Deserializing java.lang.Class

The mapper’s ClassConverter is deliberately not registered by default because reading a java.lang.Class from a document lets the document choose which class gets loaded. See the mapper documentation for the explicit allow-list registration it requires.