TINKERPOP-3279 Restrict GraphSON 1.0 embedded-type deserialization

[GumpacG]

Summary

GraphSON 1.0 with embedded types (TypeInfo.PARTIAL_TYPES) configured Jackson default typing with JsonTypeInfo.Id.CLASS and no PolymorphicTypeValidator. Reading a document reconstructed whatever class was named in its @class property, so a crafted document could name and construct (or merely load, running its static
initializer) any class on the classpath. It is reachable pre-auth via the typed GraphSON 1.0 wire serializer
GraphSONMessageSerializerV1 (application/vnd.gremlin-v1.0+json), and through io() reads and GraphSON 1.0
persistence. GraphSON 2.0/3.0 are unaffected: they resolve types through a fixed registry, not by arbitrary class name.

This change constrains that default typing while leaving legitimate value types working.

What changed

New API

• GraphSONMapper.Builder.addAllowedTypeIdPrefix(String...) trusts additional class-name prefixes for GraphSON 1.0 embedded-type deserialization, in addition to the safe defaults. Intended for provider/application types read from trusted input.

Hardened (GraphSON 1.0 PARTIAL_TYPES only)

• A custom PolymorphicTypeValidator decides a simple type id from its name, so a disallowed class is refused in validateSubClassName before it is loaded (its static initializer never runs). Array descriptors are unwrapped and allowed only when the component type is allowed; primitive arrays are allowed.
• The allow-list is derived from the types GraphSON 2.0/3.0 register (reduced to package prefixes, since V1 names concrete implementations): java.lang, java.util, java.math, java.time, java.sql, org.apache.tinkerpop, minus the network packages java.net/java.nio.
• A few safe value types in those excluded packages are allowed by exact name: java.net.InetAddress and java.net.URI (string-backed, no DNS, unlike java.net.URL).
• java.lang.Class is exact-denied even though java.lang is allowed, so a java.lang.Class value cannot name and load an arbitrary class (Jackson would otherwise resolve it with initialize=true).
• A GraphSON1dScreeningIdResolver refuses a parameterized type id (one containing <) before Jackson resolves it. This closes a bypass where a disallowed class hidden as a generic type argument was loaded before validation, and where enum type arguments were not validated at all (Jackson skips them). GraphSON 1.0 never emits a parameterized @class, so nothing legitimate is affected.

Behavior change

A GraphSON 1.0 typed document whose @class names a type outside the allowed set now fails on read:

org.apache.tinkerpop.shaded.jackson.databind.exc.InvalidTypeIdException:
Could not resolve type id ...: Configured `PolymorphicTypeValidator` ... denied resolution

Breaking changes and capability impact

Breaking: reading a GraphSON 1.0 typed document now fails, instead of deserializing, when its @class:

• names a type outside the allow-list (a provider type registered through an IoRegistry, an application POJO, most java.net.*/java.nio.* types),
• is java.lang.Class used as a value, or
• is a parameterized/generic id.

A document written by an older version that embeds such a type may no longer be readable.

Restore a specific type for trusted input by trusting its package:

GraphSONMapper.build().version(GraphSONVersion.V1_0).typeInfo(TypeInfo.PARTIAL_TYPES)
        .addAllowedTypeIdPrefix("com.example.").create();

or migrate to GraphSON 3.0 / GraphBinary. Standard scalar, collection and array values, java.math/java.time/
java.sql values, java.net.InetAddress/java.net.URI, and TinkerPop graph types are unaffected. The restriction
gates reads; the write path still emits @class for any type, so a writer and reader should be configured consistently. (java.nio.ByteBuffer is written by V1 as a concrete subtype Jackson cannot reconstruct, so it was never round-trippable in V1 and remains refused on read.)

Testing

GraphSONMapperPartialEmbeddedTypeTest covers, on the default V1 mapper:

• a disallowed @class is refused, and is not class-loaded (a static-init canary never fires);
• arrays round-trip, and an array of a disallowed component type is refused;
• a disallowed class named as a generic type argument is refused before it is loaded, and an enum type
  argument is refused (regression for the parameterized-id / enum bypass);
• a java.lang.Class value is refused and not loaded;
• a value in a denied network package (java.net.URL) is refused, while java.net.InetAddress and java.net.URI round-trip;
• java.sql/java.util value types round-trip;
• addAllowedTypeIdPrefix(...) re-enables an otherwise-denied package.

GraphSON 2.0/3.0 embedded-type and wire-serializer suites continue to pass unchanged.

Assisted-by: Kiro:claude-opus-4.8

[codecov-commenter]

Codecov Report

❌ Patch coverage is 84.05797% with 11 lines in your changes missing coverage. Please review.
✅ Project coverage is 75.63%. Comparing base (4722890) to head (7189542).
⚠️ Report is 112 commits behind head on 3.7-dev.

Files with missing lines	Patch %	Lines
.../gremlin/structure/io/graphson/GraphSONMapper.java	83.07%	9 Missing and 2 partials ⚠️

Additional details and impacted files

@@              Coverage Diff              @@
##             3.7-dev    #3586      +/-   ##
=============================================
+ Coverage      75.49%   75.63%   +0.13%     
- Complexity     13161    13239      +78     
=============================================
  Files           1092     1095       +3     
  Lines          67208    67461     +253     
  Branches        7391     7431      +40     
=============================================
+ Hits           50742    51023     +281     
+ Misses         13837    13812      -25     
+ Partials        2629     2626       -3     

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[kenhuuu]

Should this have a matching denyTypeIdPrefix() in case the current allowed list is too permissive?

[kenhuuu]

Some potential missing test cases:

1. Try cloning a GraphSONMapper to see if the allowedTypeIdPrefixes are copied over.
2. Test some invalid prefixes like null, empty and blank. Also make sure something like com.example doesn't allow something like com.exampleextendedddddddd through.
3. Add some test for the MessageSerializers or IO serializers and not just the ObjectMapper directly.

[kenhuuu]

Nit: maybe a short comment about why this StaticInitCanaryArg and StaticInitCanaryValue both need to exist. From a first glance it looks like the same class, but I'm guessing this has to do with static initialization?

[Cole-Greer]

VOTE +1

[Cole-Greer]

I think we can probably drop any threat model changes from this PR, such updates are probably best handled separately.