[DRILL-8549] Add Jackson validation of polymorphic types.

common/src/main/java/org/apache/drill/common/util/JacksonUtils.java

@@ -20,6 +20,8 @@
 import com.fasterxml.jackson.core.JsonFactory;
 import com.fasterxml.jackson.databind.ObjectMapper;
 import com.fasterxml.jackson.databind.json.JsonMapper;
+import com.fasterxml.jackson.databind.jsontype.BasicPolymorphicTypeValidator;
+import com.fasterxml.jackson.databind.jsontype.PolymorphicTypeValidator;
 
 /**
  * Utility class which contain methods for interacting with Jackson.
@@ -50,7 +52,8 @@ public static ObjectMapper createObjectMapper(final JsonFactory factory) {
    * @return an {@link JsonMapper.Builder} instance
    */
   public static JsonMapper.Builder createJsonMapperBuilder() {
-    return JsonMapper.builder();
+    return JsonMapper.builder()
+        .polymorphicTypeValidator(createPolymorphicTypeValidator());
   }
 
   /**
@@ -59,6 +62,22 @@ public static JsonMapper.Builder createJsonMapperBuilder() {
    * @return an {@link JsonMapper.Builder} instance
    */
   public static JsonMapper.Builder createJsonMapperBuilder(final JsonFactory factory) {
-    return JsonMapper.builder(factory);
+    return JsonMapper.builder(factory)
+        .polymorphicTypeValidator(createPolymorphicTypeValidator());
   }
+
+  // The more restrictive this validator is, the better for security.
+  private static PolymorphicTypeValidator createPolymorphicTypeValidator() {
+    return BasicPolymorphicTypeValidator.builder()
+        .allowIfSubType(Number.class)
+        .allowIfSubType(Boolean.class)
+        .allowIfSubType(String.class)
+        .allowIfSubType(byte[].class)
+        .allowIfSubType("java.time.")
+        .allowIfSubType("org.joda.time.") // Joda used by ColumnStatistics
+        .allowIfSubType("org.apache.drill.exec.")
+        .allowIfSubType("org.apache.drill.metastore.")
+        .build();
+  }
+
 }

exec/java-exec/src/main/java/org/apache/drill/exec/store/DrillbitPluginRegistryContext.java

@@ -45,7 +45,7 @@ public DrillbitPluginRegistryContext(DrillbitContext drillbitContext) {
     // to handle HOCON format in the override file
     LogicalPlanPersistence persistence = new LogicalPlanPersistence(drillbitContext.getConfig(),
         drillbitContext.getClasspathScan(),
-        JacksonUtils.createObjectMapper(new HoconFactory()));
+        JacksonUtils.createJsonMapperBuilder(new HoconFactory()).build());
     hoconMapper = persistence.getMapper();
   }
 

logical/src/main/java/org/apache/drill/common/config/LogicalPlanPersistence.java

@@ -65,9 +65,9 @@ public LogicalPlanPersistence(DrillConfig conf, ScanResult scanResult, ObjectMap
     mapper.setInjectableValues(injectables);
     mapper.registerModule(deserModule);
     mapper.enable(SerializationFeature.INDENT_OUTPUT);
-    mapper.configure(Feature.ALLOW_UNQUOTED_FIELD_NAMES, true);
-    mapper.configure(JsonGenerator.Feature.QUOTE_FIELD_NAMES, true);
-    mapper.configure(Feature.ALLOW_COMMENTS, true);
+    mapper.enable(Feature.ALLOW_UNQUOTED_FIELD_NAMES);
+    mapper.enable(JsonGenerator.Feature.QUOTE_FIELD_NAMES);
+    mapper.enable(Feature.ALLOW_COMMENTS);
     mapper.setFilterProvider(new SimpleFilterProvider().setFailOnUnknownId(false));
     // For LogicalOperatorBase
     registerSubtypes(getSubTypes(scanResult, LogicalOperator.class));
@@ -92,7 +92,7 @@ private <T> void registerSubtypes(Set<Class<? extends T>> types) {
    * Scan for implementations of the given interface.
    *
    * @param classpathScan Drill configuration object used to find the packages to scan
-   * @return list of classes that implement the interface.
+   * @return set of classes that implement the interface.
    */
   public static <T> Set<Class<? extends T>> getSubTypes(final ScanResult classpathScan, Class<T> parent) {
     Set<Class<? extends T>> subclasses = classpathScan.getImplementations(parent);

metastore/metastore-api/src/main/java/org/apache/drill/metastore/statistics/ColumnStatistics.java

@@ -67,9 +67,10 @@
 @JsonPropertyOrder({"statistics", "comparator"})
 public class ColumnStatistics<T> {
 
-  private static final ObjectMapper MAPPER = JacksonUtils.createJsonMapperBuilder()
-      .addModule(new JodaModule())
-      .build();
+  private static final ObjectMapper MAPPER =
+      JacksonUtils.createJsonMapperBuilder()
+        .addModule(new JodaModule())
+        .build();
 
   private static final ObjectWriter OBJECT_WRITER = MAPPER.writerFor(ColumnStatistics.class);
 

pom.xml

@@ -96,7 +96,7 @@
     <httpdlog-parser.version>5.11.0</httpdlog-parser.version>
     <iceberg.version>0.12.1</iceberg.version>
     <paimon.version>1.3.1</paimon.version>
-    <jackson.version>2.18.3</jackson.version>
+    <jackson.version>2.18.9</jackson.version>
     <janino.version>3.1.12</janino.version>
     <javassist.version>3.29.2-GA</javassist.version>
     <javax.el.version>3.0.0</javax.el.version>