Menu

#9 Allow javascript constuctor using @JSON contribution

closed
nobody
None
5
2012-02-02
2008-01-08
Chandra
No

This patch adds constructor property to JSON annoation which is used by serializer.

For instance
@JSON(constructor = "new opensocial.Person")
public class Person implements Serializable {
...
}

will serialize this as
new opesocial.Person({...}) instead of {....}.

Discussion

  • Chandra

    Chandra - 2008-01-08
     
  • Charlie Hubbard

    Charlie Hubbard - 2012-02-02
    • status: open --> closed
     
  • Charlie Hubbard

    Charlie Hubbard - 2012-02-02

    This produces invalid JSON. Embedding classes to be instantiated like this is a serious security hole. I could very easily get in the middle and send you a class to instantiate that would allow me to run remote code. For these two reasons I cannot accept this feature request and it will be closed.

     

Log in to post a comment.

MongoDB Logo MongoDB