Instruction:
作为 Java 安全专家，检测此代码中的安全漏洞：
## 内容1
### 文件路径：
release-notes/VERSION
### 代码内容：
Project: jackson-databind

------------------------------------------------------------------------
=== Releases ===
------------------------------------------------------------------------

2.6.7.2 (not yet released)
#1737: Block more JDK types from polymorphic deserialization

2.6.7.1 (11-Jul-2017)

#1383: Problem with `@JsonCreator` with 1-arg factory-method, implicit param names
#1599: Backport the extra safety checks for polymorphic deserialization

2.6.7 (05-Jun-2016)

#1194: Incorrect signature for generic type via `JavaType.getGenericSignature
#1228: @JsonAnySetter does not deserialize null to Deserializer's NullValue
 (contributed by Eric S)

2.6.6 (05-Apr-2016)

#1088: NPE possibility in SimpleMixinResolver
 (reported by Laird N)
#1099: Fix custom comparator container node traversal
 (contributed by Daniel N)
#1108: Jackson not continue to parse after DeserializationFeature.FAIL_ON_INVALID_SUBTYPE error
 (reported by jefferyyuan@github)
#1112: Detailed error message from custom key deserializer is discarded
 (contributed by Benson M)
#1120: String value omitted from weirdStringException
 (reported by Benson M)
#1123: Serializing and Deserializing Locale.ROOT
 (reported by hookumsnivy@github)

2.6.5 (19-Jan-2016)

#1052: Don't generate a spurious NullNode after parsing an embedded object
 (reported by philipa@github)
#1061: Problem with Object Id and Type Id as Wrapper Object (regression in 2.5.1)
#1073: Add try-catch around `java.sql` type serializers
 (suggested by claudemt@github)
#1078: ObjectMapper.copy() still does not preserve _registeredModuleTypes
 (reported by ajonkisz@github)

2.6.4 (07-Dec-2015)

#984: JsonStreamContexts are not build the same way for write.. and convert methods
 (reported by Antibrumm@github)
#989: Deserialization from "{}" to java.lang.Object causes "out of END_OBJECT token" error
 (reported by Ievgen P)
#1003: JsonTypeInfo.As.EXTERNAL_PROPERTY does not work with a Delegate
 (reported by alexwen@github)
#1005: Synthetic constructors confusing Jackson data binding
 (reported by Jayson M)
#1013: `@JsonUnwrapped` is not treated as assuming `@JsonProperty("")`
 (reported by David B)
#1036: Problem with case-insensitive deserialization
 (repoted by Dmitry R)
- Fix a minor problem with `@JsonNaming` not recognizing default value

2.6.3 (12-Oct-2015)

#749: `EnumMap` serialization ignores `SerializationFeature.WRITE_ENUMS_USING_TO_STRING`
 (reported by scubasau@github)
#938: Regression: `StackOverflowError` with recursive types that contain `Map.Entry`
 (reported by jloisel@github)
#939: Regression: DateConversionError in 2.6.x
 (reported by Andreas P, anpieber@github)
#940: Add missing `hashCode()` implementations for `JsonNode` types that did not have them
 (contributed by Sergio M)
#941: Deserialization from "{}" to ObjectNode field causes "out of END_OBJECT token" error
 (reported by Sadayuki F)
#942: Handle null type id for polymorphic values that use external type id
 (reported by Warren B, stormboy@github)
#943: Incorrect serialization of enum map key
 (reported by Benson M)
#944: Failure to use custom deserializer for key deserializer
 (contributed by Benson M)
#949: Report the offending substring when number parsing fails
 (contributed by Jesse W)
#965: BigDecimal values via @JsonTypeInfo/@JsonSubTypes get rounded
 (reported by gmjabs@github)

2.6.2 (14-Sep-2015)

#894: When using withFactory on ObjectMapper, the created Factory has a TypeParser
  which still has the original Factory
 (reported by lufe66@github)
#899: Problem serializing `ObjectReader` (and possibly `ObjectMapper`)
#913: ObjectMapper.copy does not preserve MappingJsonFactory features
 (reported, fixed by Daniel W)
#922: ObjectMapper.copy() does not preserve _registeredModuleTypes
#928: Problem deserializing External Type Id if type id comes before POJO

2.6.1 (09-Aug-2015)

#873: Add missing OSGi import
#881: BeanDeserializerBase having issues with non-CreatorProperty properties.
 (reported by dharaburda@github)
#884: ArrayIndexOutOfBoundException for `BeanPropertyMap` (with ObjectId)
 (reported by alterGauner@github)
#889: Configuring an ObjectMapper's DateFormat changes time zone
 (reported by Andy W, wilkinsona@github)
#890: Exception deserializing a byte[] when the target type comes from an annotation
 (reported by gmjabs@github)

2.6.0 (19-Jul-2015)

#77: Allow injection of 'transient' fields
#95: Allow read-only properties with `@JsonIgnoreProperties(allowGetters=true)`
#222: EXTERNAL_PROPERTY adds property multiple times and in multiple places
 (reported by Rob E, thatsnotright@github)
#296: Serialization of transient fields with public getters (add
    MapperFeature.PROPAGATE_TRANSIENT_MARKER)
 (suggested by Michal L)
#312: Support Type Id mappings where two ids map to same Class
#348: ObjectMapper.valueToTree does not work with @JsonRawValue
 (reported by Chris P, pimlottc@github)
#504: Add `DeserializationFeature.USE_LONG_FOR_INTS`
 (suggested by Jeff S)
#624: Allow setting external `ClassLoader` to use, via `TypeFactory`
#649: Make `BeanDeserializer` use new `parser.nextFieldName()` and `.hasTokenId()` methods
#664: Add `DeserializationFeature.ACCEPT_FLOAT_AS_INT` to prevent coercion of floating point
 numbers int `int`/`long`/`Integer`/`Long`
 (requested by wenzis@github)
#677: Specifying `Enum` value serialization using `@JsonProperty`
 (requested by Allen C, allenchen1154@github)
#679: Add `isEmpty()` implementation for `JsonNode` serializers
#688: Provide a means for an ObjectMapper to discover mixin annotation classes on demand
 (requested by Laird N)
#689: Add `ObjectMapper.setDefaultPrettyPrinter(PrettyPrinter)`
 (requested by derknorton@github)
#696: Copy constructor does not preserve `_injectableValues`
 (reported by Charles A)
#698: Add support for referential types (ReferenceType)
#700: Cannot Change Default Abstract Type Mapper from LinkedHashMap
 (reported by wealdtech@github)
#725: Auto-detect multi-argument constructor with implicit names if it is the only visible creator
#727: Improve `ObjectWriter.forType()` to avoid forcing base type for container types
#734: Add basic error-recovery for `ObjectReader.readValues()`
#737: Add support for writing raw values in TokenBuffer
 (suggested by Guillaume S, gsmet@github)
#740: Ensure proper `null` (as empty) handling for `AtomicReference`
#741: Pass `DeserializationContext' argument for `JsonDeserializer` methods "getNullValue()"
 and "getEmptyValue()"
#743: Add `RawValue` helper type, for piping raw values through `TokenBuffer`
#756: Disabling SerializationFeature.FAIL_ON_EMPTY_BEANS does not affect `canSerialize()`
 (reported by nickwongdev@github)
#762: Add `ObjectWriter.withoutRootName()`, `ObjectReader.withoutRootName()`
#765: `SimpleType.withStaticTyping()` impl incorrect
#769: Fix `JacksonAnnotationIntrospector.findDeserializer` to return `Object` (as per
  `AnnotationIntrospector`); similarly for other `findXxx(De)Serializer(...)` methods
#777: Allow missing build method if its name is empty ("")
 (suggested by galdosd@github)
#781: Support handling of `@JsonProperty.required` for Creator methods
#787: Add `ObjectMapper setFilterProvider(FilterProvider)` to allow chaining
 (suggested by rgoldberg@githin)
#790: Add `JsonNode.equals(Comparator<JsonNode>, JsonNode)` to support
  configurable/external equality comparison
#794: Add `SerializationFeature.WRITE_DATES_WITH_ZONE_ID` to allow inclusion/exclusion of
  timezone id for date/time values (as opposed to timezone offset)
#795: Converter annotation not honored for abstract types
 (reported by myrosia@github)
#797: `JsonNodeFactory` method `numberNode(long)` produces `IntNode` for small numbers
#810: Force value coercion for `java.util.Properties`, so that values are `String`s
#811: Add new option, `JsonInclude.Include.NON_ABSENT` (to support exclusion of
  JDK8/Guava Optionals)
#812: Java 8 breaks Class-value annotation properties, wrt generics: need to work around
#813: Add support for new property of `@JsonProperty.access` to support
  read-only/write-only use cases
#820: Add new method for `ObjectReader`, to bind from JSON Pointer position
 (contributed by Jerry Y, islanderman@github)
#824: Contextual `TimeZone` changes don't take effect wrt `java.util.Date`,
  `java.util.Calendar` serialization
#826: Replaced synchronized HashMap with ConcurrentHashMap in TypeDeserializerBase._findDeserializer
 (contributed by Lars P)
#827: Fix for polymorphic custom map key serializer
 (reported by mjr6140@gitgub)
#828: Respect DeserializationFeatures.WRAP_EXCEPTIONS in CollectionDeserializer
 (contributed by Steve G, thezerobit@github)
#840: Change semantics of `@JsonPropertyOrder(alphabetic)` to only count `true` value
#848: Custom serializer not used if POJO has `@JsonValue`
#849: Possible problem with `NON_EMPTY` exclusion, `int`s, `Strings`
#868: Annotations are lost in the case of duplicate methods
- Remove old cglib compatibility tests; cause problems in Eclipse
- Add `withFilterId()` method in `JsonSerializer` (demote from `BeanSerializer`)

2.5.5 (07-Dec-2015)

#844: Using JsonCreator still causes invalid path references in JsonMappingException
 (reported by Ian B)
#852: Accept scientific number notation for quoted numbers too
#878: serializeWithType on BeanSerializer does not setCurrentValue
 (reported by Chi K, chikim79@github)

2.5.4 (09-Jun-2015)

#676: Deserialization of class with generic collection inside depends on
  how is was deserialized first time
 (reported by lunaticare@github)
#771: Annotation bundles ignored when added to Mixin
 (reported by Andrew D)
#774: NPE from SqlDateSerializer as _useTimestamp is not checked for being null
 (reported by mrowkow@github)
#785: Add handlings for classes which are available in `Thread.currentThread().getContextClassLoader()`
 (contributed by Charles A)
#792: Ensure Constructor Parameter annotations are linked with those of Field, Getter, or Setter
#793: `ObjectMapper.readTree()` does not work with defaultTyping enabled
 (reported by gracefulgopher@github)
#801: Using `@JsonCreator` cause generating invalid path reference in `JsonMappingException`
 (contributed by Kamil B)
#815: Presence of PropertyNamingStrategy Makes Deserialization fail
#816: Allow date-only ISO strings to have no time zone
 (contributed by Andrew G)
- Fix handling of Enums wrt JSON Schema, when 'toString()' used for serialization

2.5.3 (24-Apr-2015)

#731: XmlAdapter result marshaling error in case of ValueType=Object
 (reported, debugged by Dmitry S)
#742: Allow deserialization of `null` Object Id (missing already allowed)
#744: Custom deserializer with parent object update failing
 (reported by migel@github)
#745: EnumDeserializer.deserializerForCreator fails when used to deserialize a Map key
 (contributed by John M)
#761: Builder deserializer: in-compatible type exception when return type is super type
 (contributed by Alexey G)
#766: Fix Infinite recursion (StackOverflowError) when serializing a SOAP object
 (contributed by Alain G)

2.5.2 (29-Mar-2015)

#609: Problem resolving locally declared generic type
 (repoted by Hal H)
#691: NullSerializer for MapProperty failing when using polymorphic handling
 (reported by Antibrumm@github)
#703: Multiple calls to ObjectMapper#canSerialize(Object.class) returns different values
 (reported by flexfrank@github)
#705: JsonAnyGetter doesn't work with JsonSerialize (except with keyUsing)
 (reported by natnan@github)
#728: TypeFactory#_fromVariable returns unknownType() even though it has enough information
  to provide a more specific type
 (reported by jkochaniak@github)
#733: MappingIterator should move past errors or not return hasNext() == true
 (reported by Lorrin N, lorrin@github)
#738: @JsonTypeInfo non-deterministically ignored in 2.5.1 (concurrency issue)
 (reported by Dylan S, dylanscott@github)
- Improvement to handling of custom `ValueInstantiator` for delegating mode; no more NPE
  if `getDelegateCreator()` returns null
- Refactor `TypedKey` into separate util class

2.5.1 (06-Feb-2015)

#667: Problem with bogus conflict between single-arg-String vs `CharSequence` constructor
#669: JSOG usage of @JsonTypeInfo and @JsonIdentityInfo(generator=JSOGGenerator.class) fails
 (reported by ericali78@github)
#671: Adding `java.util.Currency` deserialization support for maps
 (contributed by Alexandre S-C)
#674: Spring CGLIB proxies not handled as intended
 (reported by Zoltan F)
#682: Class<?>-valued Map keys not serialized properly
 (reported by Ludevik@github)
#684: FAIL_ON_NUMBERS_FOR_ENUMS does not fail when integer value is quoted
 (reported by kllp@github)
#696: Copy constructor does not preserve `_injectableValues`
 (reported by Charles A)
- Add a work-around in `ISO8601DateFormat` to allow omission of ':' from timezone
- Bit more work to complete #633

2.5.0 (01-Jan-2015)

#47: Support `@JsonValue` for (Map) key serialization
#113: Problem deserializing polymorphic types with @JsonCreator
#165: Add `DeserializationContext.getContextualType()` to let deserializer
  known the expected type.
#299: Add `DeserializationFeature.FAIL_ON_UNRESOLVED_OBJECT_IDS` to allow missing
  Object Ids (as global default)
#408: External type id does not allow use of 'visible=true'
#421: @JsonCreator not used in case of multiple creators with parameter names
 (reported by Lovro P, lpandzic@github)
#427: Make array and Collection serializers call `JsonGenerator.writeStartArray(int)`
#521: Keep bundle annotations, prevent problems with recursive annotation types
 (reported by tea-dragon@github)
#527: Add support for `@JsonInclude(content=Include.NON_NULL)` (and others) for Maps
#528: Add support for `JsonType.As.EXISTING_PROPERTY`
 (reported by heapifyman@github; implemented by fleebytes@github)
#539: Problem with post-procesing of "empty bean" serializer; was not calling
  'BeanSerializerModifier.modifySerializer()` for empty beans
 (reported by Fabien R, fabienrenaud@github)
#540: Support deserializing `[]` as null or empty collection when the java type
  is a not an object, `DeserializationFeature.ACCEPT_EMPTY_ARRAY_AS_NULL_OBJECT`
 (requested by Fabien R, fabienrenaud@github)
#543: Problem resolving self-referential recursive types
 (reported by ahgittin@github)
#550: Minor optimization: prune introspection of "well-known" JDK types
#552: Improved handling for ISO-8601 (date) format
 (contributed by Jerome G, geronimo-iia@github)
#559: Add `getDateFormat()`, `getPropertyNamingStrategy()` in `ObjectMapper`
#560: @JsonCreator to deserialize BigInteger to Enum
 (requested by gisupp@github)
#565: Add support for handling `Map.Entry`
#566: Add support for case-insensitive deserialization (`MapperFeature.ACCEPT_CASE_INSENSITIVE_PROPERTIES`)
 (contributed by Michael R)
#571: Add support in ObjectMapper for custom `ObjectReader`, `ObjectWriter` (sub-classes)
#572: Override default serialization of Enums
 (requested by herau@github)
#576: Add fluent API for adding mixins
 (contributed by Adam S, adstro@github)
#594: `@JsonValue` on enum not used when enum value is a Map key
 (reported by chrylis@github)
#596: Add support for `@JsonProperty.defaultValue`, exposed via `BeanProperty.getMetadata().getDefaultValue()`
#597: Improve error messaging for cases where JSON Creator returns null (which
  is illegal)
 (contributed by Aurelien L)
#599: Add a simple mechanism for avoiding multiple registrations of the same module
#607: Allow (re)config of `JsonParser.Feature`s via `ObjectReader`
#608: Allow (re)config of `JsonGenerator.Feature`s via `ObjectWriter`
#614: Add a mechanism for using `@JsonCreator.mode` for resolving possible ambiguity between
  delegating- and property-based creators
#616: Add `SerializationFeature.WRITE_DURATIONS_AS_TIMESTAMPS`
#622: Support for non-scalar ObjectId Reference deserialiazation (like JSOG)
#623: Add `StdNodeBasedDeserializer`
#630: Add `KeyDeserializer` for `Class`
#631: Update `current value` of `JsonParser`, `JsonGenerator` from standard serializers,
 deserializers
 (suggested by Antibrumm@github)
#633: Allow returning null value from IdResolver to make type information optional
 (requested by Antibrumm@github)
#634: Add `typeFromId(DatabindContext,String)` in `TypeIdDeserializer`
#636: `ClassNotFoundException` for classes not (yet) needed during serialization
 (contributed by mspiegel@github)
#638: Add annotation-based method(s) for injecting properties during serialization
 (using @JsonAppend, VirtualBeanPropertyWriter)
#647: Deserialization fails when @JsonUnwrapped property contains an object with same property name
 (reported by Konstantin L)
#653: Jackson doesn't follow JavaBean naming convention (added `MapperFeature.USE_STD_BEAN_NAMING`)
#654: Add support for (re)configuring `JsonGenerator.setRootValueSeparator()` via `ObjectWriter`
#655: Add `ObjectWriter.writeValues()` for writing value sequences
#660: `@JsonCreator`-annotated factory method is ignored if constructor exists
- Allow use of `Shape.ARRAY` for Enums, as an alias to 'use index'
- Start using `JsonGenerator.writeStartArray(int)` to help data formats
  that benefit from knowing number of elements in arrays (and would otherwise
  need to buffer values to know length)
- Added new overload for `JsonSerializer.isEmpty()`, to eventually solve #588
- Improve error messaging (related to [jaxb-annotations#38]) to include known subtype ids.

2.4.6 (23-Apr-2015)

#735: (complete fix) @JsonDeserialize on Map with contentUsing custom deserializer overwrites default behavior
 (reported by blackfyre512@github) (regression due to #604)
$744: Custom deserializer with parent object update fails

2.4.5.1 (26-Mar-2015)

Special one-off "micro patch" for:

#706: Add support for `@JsonUnwrapped` via JSON Schema module
#707: Error in getting string representation of an ObjectNode with a float number value
 (reported by @navidqar)
#735: (partial) @JsonDeserialize on Map with contentUsing custom deserializer overwrites default behavior

2.4.5 (13-Jan-2015)

#635: Reduce cachability of `Map` deserializers, to avoid problems with per-property config changes
    (regression due to #604)
#656: `defaultImpl` configuration is ignored for `WRAPPER_OBJECT`
- Solve potential cyclic-resolution problem for `UntypedObjectDeserializer`

2.4.4 (24-Nov-2014)

(jackson-core)#158: Setter confusion on assignable types
 (reported by tsquared2763@github)
#245: Calls to ObjectMapper.addMixInAnnotations() on an instance returned by ObjectMapper.copy()
 don't work
 (reported by Erik D)
#580: delegate deserializers choke on a (single) abstract/polymorphic parameter
 (reported by Ian B, tea-dragon@github)
#590: Binding invalid Currency gives nonsense at end of the message
 (reported by Jerbell@github)
#592: Wrong `TokenBuffer` delegate deserialization using `@JsonCreator`
 (reported by Eugene L)
#601: ClassCastException for a custom serializer for enum key in `EnumMap`
 (reported by Benson M)
#604: `Map` deserializers not being cached, causing performance problems
#610: Fix forward reference in hierarchies
 (contributed by zeito@github)
#619: Off by one error in AnnotatedWithParams
 (reported by stevetodd@github)
- Minor fix to `EnumSerializer` regarding detection "serialize using index"
- Minor fix to number serializers, to call proper callback for schema generation

2.4.3 (02-Oct-2014)

#496: Wrong result with `new TextNode("false").asBoolean(true)`
 (reported by Ivar R, ivarru@github)
#511: DeserializationFeature.FAIL_ON_INVALID_SUBTYPE does not work
 (reported by sbelikov@github)
#523: MapDeserializer and friends do not report the field/key name for mapping exceptions
 (reported by Ian B, tea-dragon@github)
#524: @JsonIdentityReference(alwaysAsId = true) Custom resolver is reset to SimpleObjectIdResolver
 (reported by pkokorev@github)
#541: @JsonProperty in @JsonCreator is conflicting with POJOs getters/attributes
 (reported by fabienrenaud@github)
#543: Problem resolving self-referential generic types
#570: Add Support for Parsing All Compliant ISO-8601 Date Formats
 (requested by pfconrey@github)
- Fixed a problem with `acceptJsonFormatVisitor` with Collection/array types that
  are marked with `@JsonValue`; could cause NPE in JSON Schema generator module.

2.4.2 (14-Aug-2014)

#515: Mixin annotations lost when using a mixin class hierarchy with non-mixin interfaces
 (reported by 'stevebread@github')
- Fixed a problem related to [jackson-dataformat-smile#19].

2.4.1.2 (12-Jul-2014)

Special one-off "micro patch" for:

#503: Concurrency issue inside com.fasterxml.jackson.databind.util.LRUMap.get(Object)
 (reported by fjtc@github)

2.4.1.1 (18-Jun-2014)

Special one-off "micro patch" for:

#491: Temporary work-around for issue #490 (full fix for 2.5 needs to be
  in `jackson-annotations`)
#506: Index is never set for Collection and Array in InvalidFormatException.Reference
 (reported by Fabrice D, fabdouglas@github)
- Fixed a problem related to [jackson-dataformat-smile#19].

2.4.1 (17-Jun-2014)

#479: NPE on trying to deserialize a `String[]` that contains null
 (reported by huxi@github)
#482: Make date parsing error behavior consistent with JDK
 (suggested by Steve S, sanbeg@github)
#489 (partial): TypeFactory cache prevents garbage collection of custom ClassLoader
 (reported by sftwrengnr@github)

2.4.0 (02-Jun-2014)

#81: Allow use of @JsonUnwrapped with typed (@JsonTypeInfo) classes, provided
  that (new) feature `SerializationFeature.FAIL_ON_UNWRAPPED_TYPE_IDENTIFIERS`
  is disabled
 (constributed by Ben F, UnquietCode@github)
#88: Prevent use of type information for `JsonNode` via default typing
 (reported by electricmonk@github)
#149: Allow use of "stringified" indexes for Enum values
 (requested by chenboxiang@github)
#176: Allow use external Object Id resolver (to use with @JsonIdentityInfo etc)
 (implemented by Pascal G)
#193: Conflicting property name definitions
 (reported by Stuart J, sgjohnston@github)
#323: Serialization of the field with deserialization config
 (reported by metanet@github)
#327: Should not consider explicitly differing renames a fail, as long as all are explicit
#335: Allow use of `@JsonPropertyOrder(alphabetic=true)` for Map properties
#352 Add `ObjectMapper.setConfig()` for overriding `SerializationConfig`/`DeserializationConfig`
#353: Problems with polymorphic types, `JsonNode` (related to #88)
 (reported by cemo@github)
#359: Converted object not using explicitly annotated serializer
 (reported by Florian S [fschopp@github])
#369: Incorrect comparison for renaming in `POJOPropertyBuilder`
#375: Add `readValue()`/`readPropertyValue()` methods in `DeserializationContext`
#376: Add support for `@JsonFormat(shape=STRING)` for number serializers
#381: Allow inlining/unwrapping of value from single-component JSON array
 (contributed by yinzara@github)
#390: Change order in which managed/back references are resolved (now back-ref
 first, then forward)
 (requested by zAlbee@github)
#407: Properly use null handlers for value types when serializer Collection
 and array types
 (contributed by Will P)
#425: Add support for using `Void.class` as "no class", instead of `NoClass.class`
#428: `PropertyNamingStrategy` will rename even explicit name from `@JsonProperty`
 (reported by turskip@github)
#435: Performance bottleneck in TypeFactory._fromClass
 (reported by Sean D, sdonovanuk@github)
#434: Ensure that DecimalNodes with mathematically equal values are equal
 (contributed by Francis G)
#435: Performance bottleneck in TypeFactory._fromClass
 (reported by sdonovanuk@github)
#438: Add support for accessing `@JsonProperty(index=N)` annotations
#442: Make `@JsonUnwrapped` indicate property inclusion
 (suggested by Ben F)
#447: ArrayNode#addAll should accept Collection<? extends JsonNode>
 (suggested by alias@github)
#461: Add new standard naming strategy, `PropertyNamingStrategy.LowerCaseStrategy`
#463: Add 'JsonNode.asText(String defaultValue)`
 (suggested by Chris C)
#464: Include `JsonLocation` in more mapping exceptions
 (contributed by Andy C (q3aiml@github))
#465: Make it easier to support serialization of custom subtypes of `Number`
#467: Unwanted POJO's embedded in tree via serialization to tree
 (reported by Benson M)
- Slightly improve `SqlDateSerializer` to support `@JsonFormat`
- Improve handling of native type ids (YAML, CBOR) to use non-native type ids
  as fallback

2.3.5 (13-Jan-2015)

#496: Wrong result for TextNode("false").asBoolean(true)
 (reported by Ivar R, ivarru@github)
#543: Problems resolving self-referential generic types.
#656: defaultImpl configuration is ignored for WRAPPER_OBJECT

2.3.4 (17-Jul-2014)

#459: BeanDeserializerBuilder copy constructor not copying `_injectables`
#462: Annotation-provided Deserializers are not contextualized inside CreatorProperties
 (reported by aarondav@github)

2.3.3 (10-Apr-2014)

#420: Remove 'final' modifier from `BeanDeserializerBase.deserializeWithType`
 (requested by Ghoughpteighbteau@github)
#422: Allow use of "True" and "False" as aliases for booleans when coercing from
  JSON String
#423: Fix `CalendarSerializer` to work with custom format
 (reported by sergeymetallic@github)
#433: `ObjectMapper`'s `.valueToTree()` wraps `JsonSerializable` objects into a POJONode
 (reported by Francis G)
- Fix null-handling for `CollectionSerializer`

2.3.2 (01-Mar-2014)

#378: Fix a problem with custom enum deserializer construction
 (reported by BokoEnos@github)
#379: Fix a problem with (re)naming of Creator properties; needed to make
 Paranamer module work with NamingStrategy.
 (reported by Chris P, cpilsworth@github)
#398: Should deserialize empty (not null) URI from empty String
 (reported by pgieser@github)
#406: @JsonTypeIdResolver not working with external type ids
 (reported by Martin T)
#411: NumberDeserializers throws exception with NaN and +/- Infinity
 (reported by clarkbreyman@github)
#412: ObjectMapper.writerWithType() does not change root name being used
 (repoted by jhalterman@github)
- Added `BeanSerializerBase._serializeObjectId()` needed by modules that
  override standard BeanSerializer; specifically, XML module.

2.3.1 (28-Dec-2013)

#346: Fix problem deserializing `ObjectNode`, with @JsonCreator, empty
  JSON Object
 (reported by gaff78@github)
#358: `IterableSerializer` ignoring annotated content serializer
 (reported by Florian S)
#361: Reduce sync overhead for SerializerCache by using volatile, double-locking
 (contributed by stuartwdouglas@github)
#362: UUID output as Base64 String with ObjectMapper.convertValue()
 (reported by jknack@github)
#367: Make `TypeNameIdResolver` call `TypeResolver` for resolving base type
 (suggested by Ben F)
#370: Fail to add Object Id for POJO with no properties
 (reported by jh3141@github)
- Fix for [jackson-module-afterburner#38]: need to remove @JacksonStdImpl from
  `RawSerializer`, to avoid accidental removal of proper handling.

2.3.0 (13-Nov-2013)

#48: Add support for `InetSocketAddress`
 (contributed by Nick T)
#152: Add support for traversing `JsonNode` with (new!) `JsonPointer` implementation
 (suggested by fge@github)
#208: Accept "fromString()" as an implicit Creator (factory) method (alias for "valueOf()")
 (requested by David P)
#215: Allow registering custom `CharacterEscapes` to use for serialization,
 via `ObjectWriter.with(CharacterEscapes)` (and `ObjectMapper.writer(CharacterEscapes)`)
#227: Allow "generic" Enum serializers, deserializers, via `SimpleModule`
#234: Incorrect type information for deeply nested Maps
 (reported by Andrei P)
#237: Add `DeserializationFeature.FAIL_ON_READING_DUP_TREE_KEY` to optionally
  throw `JsonMappingException` on duplicate keys, tree model (`JsonNode`)
#238: Allow existence of overlapping getter, is-getter (choose 'regular' getter)
#239: Support `ByteBuffer`
 (suggested by mckamey@github)
#240: Make sure `@JsonSerialize.include` does not accidentally override
  class inclusion settings
 (requested by thierryhenrio@github)
#253: `DelegatingDeserializer` causes problems for Managed/BackReferences
 (reported by bfelaco@github)
#257: Make `UntypedObjectDeserializer` support overides for `List`, `Map` etc
#268: Add new variant of `ObjectMapper.canSerialize()` that can return `Throwable`
 that caused false to be returned (if any)
#269: Add support for new `@JsonPropertyDescription` via `AnnotationIntrospector`
 as well as `BeanProperty.getMedata().getDescription()`
#270: Add `SerializationFeature.USE_EQUALITY_FOR_OBJECT_ID` to allow use of equality
 (instead of identity) for figuring out when to use Object Id
 (requested by beku8@github)
#271: Support handling of `@JsonUnwrapped` for in-built JSON Schema generation
#277: Make `TokenBuffer` support new native type and object ids
#302: Add `setNamingStrategy` in `Module.SetupContext`
 (suggested by Miguel C)
#305: Add support for accessing `TypeFactory` via `TypeIdResolverBase`
 (not yet via `TypeIdResolver` interface), other configuration
#306: Allow use of `@JsonFilter` for properties, not just classes
#307: Allow use of `@JsonFilter` for Maps in addition to POJOs
#308: Improve serialization and deserialization speed of `java.util.UUID` by 4x
 (suggested by David P)
#310: Improve `java.util.UUID` serialization with binary codecs, to use "raw" form.
#311: Make sure that "creator properties" are alphabetically ordered too, if
  so requested.
#315: Allow per-property definition of null serializer to use, using
 new `@JsonSerialize(nullsUsing=xxx)` annotation property
#317: Fix `JsonNode` support for nulls bound to `ObjectNode`, `ArrayNode`
 (contributed by Seth P)
#318: Problems with `ObjectMapper.updateValue()`, creator property-backed accessors
#319: Add support for per-call ("contextual") attributes, with defaulting,
 to allow keeping track of state during (de)serialization
#324: Make sure to throw `JsonMappingException` from `EnumDeserializer` creator,
  not `IllegalArgumentException`
 (reported by beverku@github)
#326: Support `@JsonFilter` for "any getter" properties
#334: Make `ArrayNode`, `ObjectNode` non-final again
#337: `AnySetter` does not support polymorphic types
 (reported by askvortsov@github)
#340: AtomicReference not working with polymorphic types
#342: Add `DeserializationFeature.FAIL_ON_IGNORED_PROPERTIES` to make `ObjectMapper`
  throw exception when encountering explicitly ignored properties
 (requested by Ruslan M)
[JACKSON-890]: Support managed/back-references for polymorphic (abstract) types
- Add 'BeanPropertyWriter.isUnwrapping()' for future needs (by Afterburner)
- Add coercions from String "null" (as if null token was parsed) for primitives/Wrappers.
- Add `JsonDeserializer.handledType()`

2.2.4 (10-Jun-2014)

#292: Problems with abstract `Map`s, `Collection`s, polymorphic deserialization
#324: EnumDeserializer should throw JsonMappingException, not IllegalArgumentException
#346: Problems deserializing `ObjectNode` from empty JSON Object, with @JsonCreator

2.2.3 (22-Aug-2013)

#234: Problems with serializing types for deeply nested generic Maps, default typing
#251: SerializationFeature.WRITE_BIGDECIMAL_AS_PLAIN ignored with JsonNode
  serialization
 (reported by fge@github)
#259: Fix a problem with JSON Schema generation for `@JsonValue`
 (reported by Lior L)
#267: Handle negative, stringified timestamps
 (reported by Drecth@github)
#281: Make `NullNode` use configured null-value serializer
#287: Fix problems with converters, Maps with Object values
 (reported by antubis@github)
#288: Fix problem with serialization converters assigned with annotations
 (reported by cemo@github)

2.2.2 (26-May-2013)

#216: Problems with Android, 1.6-only types
#217: JsonProcessingExceptions not all wrapped as expected
 (reported by karldmoore@github)
#220: ContainerNode missing 'createNumber(BigInteger)'
 (reported by Pascal G)
#223: Duplicated nulls with @JsonFormat(shape=Shape.ARRAY)
 (reported by lukegh@github)
#226: Field mapping fail on deserialization to common referenced object when
  @JsonUnwrapped is used
 (reported by ikvia@github)
#232: Converting bound BigDecimal value to tree fails with WRITE_BIGDECIMAL_AS_PLAIN
 (reported by celkings@github)
- Minor fix to handle primitive types for key deserializer lookups
- Add convenience method `MappingIterator.getCurrentLocation()`
 (suggested by Tomdz@github)

2.2.1 (03-May-2013)

#214: Problem with LICENSE, NOTICE, Android packaging
 (reported by thierryd@github)

2.2.0 (22-Apr-2013)

Fixes:

#23: Fixing typing of root-level collections
#118: JsonTypeInfo.as.EXTERNAL_PROPERTY not working correctly
 with missing type id, scalar types
#130: TimeZone not set for GregorianCalendar, even if configured
#144: MissingNode.isValueNode() should return 'false'
 (reported by 'fge@github')
#146: Creator properties were not being renamed as expected
 (contributed by Christoper C)
#188: Problem with ObjectId serialization, 'alwaysAsId' references

Improvements:

#116: JavaType implements `java.lang.reflect.Type` (as does `TypeReference`)
#147: Defer reporting of problems with missing creator parameters
 (contributed by Christoper C)
#155: Make `ObjectNode` and `ArrayNode` final (other node types already were)
 (requested by fge@github)
#161: Add deserializer for java.util.concurrent.ArrayBlockingQueue
#173: Add 'JsonNode.traverse(ObjectCodec)' for convenience
#181: Improve error reporting for missing '_valueDeserializer'
#194: Add `FloatNode` type in tree model (JsonNode)
 (requested by msteiger@github)
#199: Allow deserializing `Iterable` instances (as basic `Collection`s)
 (requested by electrum@github)
#206: Make 'ObjectMapper.createDeserializationContext()' overridable
 (requested by noter@github)
#207: Add explicit support for `short` datatypes, for tree model
 (contributed by msteiger@github)

New features:

#120: Extend BeanDeserializerModifier to work with non-POJO deserializers
#121: Extend BeanSerializerModifier to work with non-POJO serializers
#124: Add support for serialization converters (@JsonSerializer(converter=...))
#124: Add support for deserialization converters (@JsonDeserializer(converter=...))
#140: Add 'SerializationFeature.WRITE_BIGDECIMAL_AS_PLAIN' to allow forcing
  of non-scientific notation when serializing BigDecimals.
 (suggested by phedny@github)
#148: Add 'DeserializationFeature.FAIL_ON_INVALID_SUBTYPE`, which allows mapping
  entries with missing or invalid type id into null references (instead of failing).
  Also allows use of '@JsonTypeInfo.defaultImpl = NoClass.class' as alternative.
#159: Add more accessors in 'MappingIterator': getParser(), getParserSchema(),
  readAll()
 (suggested by Tom D)
#190: Add 'MapperFeature.ALLOW_FINAL_FIELDS_AS_MUTATORS' (default: true) for
 pruning out final fields (to avoid using as mutators)
 (requested by Eric T)
#195: Add 'MapperFeature.INFER_PROPERTY_MUTATORS' (default: enabled) for finer
  control of what mutators are auto-detected.
 (requested by Dain S)
#198: Add SPI metadata, handling in ObjectMapper (findModules()), for
  automatic registration of auto-detected extension modules
 (suggested by 'beamerblvd@github')
#203: Added new features to support advanced date/time handling:
  - SerializationFeature.WRITE_DATE_TIMESTAMPS_AS_NANOSECONDS
  - DeserializationFeature.READ_DATE_TIMESTAMPS_AS_NANOSECONDS
  - DeserializationFeature.ADJUST_DATES_TO_CONTEXT_TIME_ZONE

Other:

#126: Update JDK baseline to 1.6
* API under 'com.fasterxml.jackson.databind.jsonFormatVisitors' changed significantly
  based on experiences with external JSON Schema generator.
* Version information accessed via code-generated access class, instead of reading
  VERSION.txt
* Added 2 methods in Converter interface: getInputType(), getOutputType(),
  to allow programmatic overrides (needed by JAXB annotation module)

2.1.4 (26-Feb-2013)

* [JACKSON-887]: StackOverflow with parameterized sub-class field
 (reported by Alexander M)
* [#130]: TimeZone not set for GregorianCalendar, when deserializing
* [#157]: NPE when registering module twice
* [#162]: JsonNodeFactory: work around an old bug with BigDecimal and zero
 (submitted by fge@github)
* [#166]: Incorrect optimization for `ObjectMapper.convertValue(Class)`
 (reported by Eric T)
* [#167]: Problems with @JsonValue, polymorphic types (regression from 1.x)
 (reported by Eric T)
* [#170]: Problems deserializing `java.io.File` if creator auto-discovery disabled
 (reported by Eric T)
* [#175]: NPE for JsonMappingException, if no path is specified
 (reported by bramp@github)

2.1.3 (19-Jan-2013)

* [Issue#141]: ACCEPT_EMPTY_STRING_AS_NULL_OBJECT not working for enums
* [Issue#142]: Serialization of class containing EnumMap with polymorphic enum
  fails to generate class type data
 (reported by kidavis4@github)

2.1.2 (04-Dec-2012)

* [Issue#106]: NPE in ObjectArraySerializer.createContextual(...)
* [Issue#117]: HandlerInstantiator defaulting not working
 (reported by Alexander B)
* [Issue#118]: Problems with JsonTypeInfo.As.EXTERNAL_PROPERTY, scalar values
 (reported by Adva11@github)
* [Issue#119]: Problems with @JsonValue, JsonTypeInfo.As.EXTERNAL_PROPERTY
 (reported by Adva11@github)
* [Issue#122]: ObjectMapper.copy() was not copying underlying mix-in map
 (reported by rzlo@github)

2.1.1 (11-Nov-2012)

Fixes:

* [JACKSON-875]: Enum values not found if Feature.USE_ANNOTATIONS disabled
 (reported by Laurent P)
* [Issue#93]: ObjectNode.setAll() broken; would not add anything for
  empty ObjectNodes.
 (reported by Francis G)
* Making things implement java.io.Serializable:
  - Issues: #94, #99, #100, #102
    (reported by Sean B)
* [Issue#96]: Problem with JsonTypeInfo.As.EXTERNAL_PROPERTY, defaultImpl
 (reported by Adva11@github)

2.1.0 (08-Oct-2012)

  New minor version for 2.x series. Major improvements in multiple areas,
  including:

  - Dataformat auto-detection
  - More `@JsonFormat.shape` variant to serialize Collections as
    JSON Objects, POJOs as JSON Arrays (csv-like).
  - Much more configuration accessible via ObjectReader, ObjectWriter
  - New mechanism for JSON Schema generation, other uses (in future)

Fixes:

* [JACKSON-830]/[Issue#19]: Change OSGi bundle name to be fully-qualified
* ]JACKSON-847]: Make @JsonIdentityInfo work with property-based creator
* [JACKSON-851]: State corruption with ObjectWriter, DefaultPrettyPrinter
 (reported by Duncan A)
* [Issue#75]: Too aggressive KeySerializer caching
* Minor fix wrt [Issue#11], coercion needed extra checks

Improvements:

* [JACKSON-758]: Remove 'IOException' from throws clauses of "writeValueAsString"
  and "writeValueAsBytes" of ObjectMapper/ObjectWriter
 (suggested by G-T Chen)
* [JACKSON-839]: Allow "upgrade" of integer number types for
  UntypedObjectDeserializer, even with default typing enabled.
* [JACKSON-850]: Allow use of zero-arg factory methods as "default creator"
  (suggested by Razvan D)
* [Issue#9]: Implement 'required' JSON Schema attribute for bean properties
* [Issue#20]: Add new exception type, InvalidFormatException (sub-type of
  JsonMappingException) to indicate data format problems
 (suggested by HolySamosa@github)
* [Issue#30]: ObjectReader and ObjectWriter now try to pre-fetch root
  (de)serializer if possible; minor performance improvement (2% for small POJOs).
* [Issue#33]: Simplified/clarified definition of 'ObjectReader.readValues()';
  minor change in behavior for JSON Array "wrapped" sequences
* [Issue#60]: Add 'JsonNode.hasNonNull(...)' method(s)
 (suggested by Jeff S on mailing list)
* [Issue#64]: Add new "standard" PropertyNamingStrategy, PascalCaseStrategy
  (PropertyNamingStrategy.PASCAL_CASE_TO_CAMEL_CASE)
 (contributed by Sean B)
* [Issue#65]: Add getters to `ObjectMapper`, DeserializationContext/-Factory.
 (contributed by Dmitry K)
* [Issue#69]: Add `PropertyName` abstraction, new methods in AnnotationIntrospector
* [Issue#80]: Make `DecimalNode` normalize input, to make "1.0" and "1.00"equal
 (reported by fge@github)

New features:

* [Issue#15]: Support data format auto-detection via ObjectReader (added
  'withFormatDetection(...)' fluent factories)
* [Issue#21]: Add 'ObjectNode.set(...)' method (and related) to improve
  chaining, semantic consistency of Tree Model API
 (suggested by fge@Github)
* [Issue#22]: Add 'ObjectMapper.setAnnotationIntrospectors()' which allows
  defining different introspectors for serialization, deserialization
* [Issue#24]: Allow serialization of Enums as JSON Objects
 (suggested by rveloso@github)
* [Issue#28]: Add 'ObjectMapper.copy()', to create non-linked copy of
  mapper, with same configuration settings
* [Issue#29]: Allow serializing, deserializing POJOs as JSON Arrays
  by using `@JsonFormat(shape=Shape.ARRAY)`
* [Issue#40]: Allow serialization of Collections as JSON Objects
  (and deserialization from)
 (suggested by 'rveloso@github')
* [Issue#42]: Allow specifying Base64 variant to use for Base64-encoded data
  using ObjectReader.with(Base64Variant), ObjectWriter.with(Base64Variant).
 (suggested by 'mpfau@github')
* [Issue#45]: Add '@JsonNaming' annotation to define per-class PropertyNamingStrategy
 (suggested by Mark W)
* [Pull#58]: Make 'MappingIterator' implement 'Closable'
 (contributed by Pascal G)
* [Issue#72]: Add 'MapperFeature.USE_WRAPPER_NAME_AS_PROPERTY_NAME' to use
  wrapper name annotations for renaming properties
* [Issue#87]: Add 'StdDelegatingSerializer', 'StdDelegatingDeserializer' to
  simplify writing of two-step handlers
* (issue #4 of jackson-annotations): Add `@JsonIdentityReference(alwaysAsId=true)`
  to force ALL references to an object written as Object Id, even the first one.
* Added 'ObjectReader#withHandler' to allow for reconfiguring deserialization
  problem handler
 (suggested by 'electricmonk')

Other changes:

* New variant of AnnotationIntrospector.getFormat(), to support class
  annotations
* It is now possible to serialize instances of plain old Object, iff
  'FAIL_ON_EMPTY_BEANS' is disabled.
* Trying to remove reference to "JSON" in datatype conversion errors
 (since databinding is format-agnostic)

INCOMPATIBILITIES: (rats!)

* Note that [Issue#33] (see above) is, technically speaking, backwards
  imcompatible change. It is estimated that it should NOT affect most
  users, as changes are to edge cases (and undocumented ones at that).
  However, it can potentially cause problems with upgrade.
* Implementation of `JsonFormatVisitable` resulting in 2 new methods
  being added in `BeanPropertyFilter` interface -- this is unfortunate,
  but was required to support full traversability.

2.0.4 (26-Jun-2012)

* [Issue#6]: element count for PrettyPrinter, endObject wrong
   (reported by "thebluemountain")
* [JACKSON-838]: Utf8StreamParser._reportInvalidToken() skips letters
    from reported token name
   (reported by Lóránt Pintér)
* [JACKSON-841] Data is doubled in SegmentedStringWriter output
   (reported by Scott S)
* [JACKSON-842] ArrayIndexOutOfBoundsException when skipping C-style comments
   (reported by Sebastien R)

2.0.3: no version 2.0.3 released -- only used for extension modules

2.0.2 [14-May-2012]

Fixes:

* [Issue#14]: Annotations were not included from parent classes of
  mix-in classes
 (reported by @guillaup)
* [JACKSON-824]: Combination of JSON Views, ObjectMapper.readerForUpdating()
  was not working
 (reported by Nir S)
(and all fixes from 1.9.7)

Improvements:

* [Issue#11]: Improve ObjectMapper.convertValue()/.treeToValue() to use
  cast if possible

2.0.1 [23-Apr-2012]

Fixes:

* [JACKSON-827] Ensure core packages work on JDK 1.5
 (reported by Pascal g)
* [JACKSON-829] Custom serializers not working for List<String> properties,
  @JsonSerialize(contentUsing)
 (reported by James R)

Improvements:

* [Issue#5]: Add support for maps with java.util.Locale keys to the set of
  StdKeyDeserializers
 (contributed by Ryan G)

2.0.0 [25-Mar-2012]

Fixes:

* [JACKSON-368]: Problems with managed references, abstract types
* [JACKSON-711]: Delegating @JsonCreator did not work with Injectable values
* [JACKSON-798]: Problem with external type id, creators
  (reported by Casey L)
(and all fixes up until and including 1.9.6)

Improvements:

* [JACKSON-546]: Indicate end-of-input with JsonMappingException instead
  of EOFException, when there is no parsing exception
* [JACKSON-664]: Reduce overhead of type resolution by adding caching
  in TypeFactory
* [JACKSON-690]: Pass DeserializationContext through ValueInstantiator
* [JACKSON-695]: Add 'isEmpty(value)' in JsonSerializer to allow
  customizing handling of serialization of empty values
* [JACKSON-710]: 'ObjectMapper.convertValue()' should ignore root value
  wrapping/unwrapping settings
* [JACKSON-730] Split various features (JsonParser, JsonGenerator,
  SerializationConfig, DeserializationConfig) into per-factory
  features (MapperFeature, JsonFactory.Feature) an per
  instance features (existing ones)
* [JACKSON-732]: Allow 'AnnotationIntrospector.findContentDeserializer()'
  (and similar) to return instance, not just Class<?> for instance
 (requested by James R)
* [JACKSON-736]: Add (more) access to array, container and map serializers
* [JACKSON-737]: Allow accessing of "creator properties" for BeanDeserializer
* [JACKSON-748]: Add 'registerSubtypes' to 'Module.setupContext' (and SimpleModule)
* [JACKSON-749]: Make @JsonValue work for Enum deserialization
* [JACKSON-769]: ObjectNode/ArrayNode: change 'put', 'insert', 'add' to return
  'this node' (unless already returning something)
* [JACKSON-770]: Simplify method naming for JsonNode, drop unnecessary 'get' prefix
  from methods like 'getTextValue()' (becomes 'textValue()')
* [JACKSON-777]: Rename 'SerializationConfig.Feature' as 'SerializationFeature',
  'DeserializationConfig.Feature' as 'DeserializationFeature'
* [JACKSON-780]: MissingNode, NullNode should return 'defaultValue' from 'asXxx' methods,
  (not 0 for numbers), as they are not numeric types
* [JACKSON-787]: Allow use of @JsonIgnoreProperties for properties (fields, getters, setters)
* [JACKSON-795]: @JsonValue was not working for Maps, Collections
* [JACKSON-800]: Add 'Module.SetupContext#addDeserializationProblemHandler'
 (suggested by James R)

New features:

* [JACKSON-107]: Add support for Object Identity (to handled cycles, shared refs),
  with @JsonIdentityInfo
* [JACKSON-435]: Allow per-property Date formatting using @JsonFormat.
* [JACKSON-437]: Allow injecting of type id as POJO property, by setting
  new '@JsonTypeInfo.visible' property to true.
* [JACKSON-469]: Support "Builder pattern" for deserialiation; that is, allow
  use of separate Builder object for data binding, creating actual value
* [JACKSON-608]: Allow use of JSON Views for deserialization
* [JACKSON-636]: Add 'SerializationFeature.ORDER_MAP_ENTRIES_BY_KEYS' to allow
  forced sorting of Maps during serialization
  (suggested by Joern H)
* [JACKSON-669]: Allow prefix/suffix for @JsonUnwrapped properties
 (requested by Aner P)
* [JACKSON-707]: Add 'JsonNode.deepCopy()', to create safe deep copies
  of ObjectNodes, ArrayNodes.
* [JACKSON-714]: Add general-purpose @JsonFormat annotation
* [JACKSON-718]: Added 'JsonNode.canConvertToInt()', 'JsonNode.canConvertToLong()'
* [JACKSON-747]: Allow changing of 'SerializationFeature' for ObjectWriter,
  'DeserializationFeature' for ObjectReader.
* [JACKSON-752]: Add @JsonInclude (replacement of @JsonSerialize.include)
* [JACKSON-754]: Add @JacksonAnnotationsInside for creating "annotation
  bundles" (also: AnnotationIntrospector.isAnnotationBundle())
* [JACKSON-762]: Allow using @JsonTypeId to specify property to use as
  type id, instead of using separate type id resolver.
* [JACKSON-764]: Allow specifying "root name" to use for root wrapping
  via ObjectReader, ObjectWriter.
* [JACKSON-772]: Add 'JsonNode.withArray()' to use for traversing Array nodes.
* [JACKSON-793]: Add support for configurable Locale, TimeZone to use
  (via SerializationConfig, DeserializationConfig)
* [JACKSON-805]: Add 'SerializationFeature.WRITE_SINGLE_ELEM_ARRAYS_UNWRAPPED'
  to improve interoperability with BadgerFish/Jettison
* [JACKSON-810]: Deserialization Feature: Allow unknown Enum values via
  'DeserializationFeature.READ_UNKNOWN_ENUM_VALUES_AS_NULL'
  (suggested by Raymond R)
* [JACKSON-813]: Add '@JsonSerializableSchema.id' attribute, to indicate
  'id' value to add to generated JSON Schemas.

[entries for versions 1.x and earlier not retained; refer to earlier releases)

## 内容2
### 文件路径：
src/main/java/com/fasterxml/jackson/databind/deser/BeanDeserializerFactory.java
### 代码内容：
package com.fasterxml.jackson.databind.deser;

import java.lang.reflect.Type;
import java.util.*;

import com.fasterxml.jackson.annotation.ObjectIdGenerator;
import com.fasterxml.jackson.annotation.ObjectIdGenerators;
import com.fasterxml.jackson.annotation.ObjectIdResolver;
import com.fasterxml.jackson.databind.*;
import com.fasterxml.jackson.databind.annotation.JsonPOJOBuilder;
import com.fasterxml.jackson.databind.cfg.DeserializerFactoryConfig;
import com.fasterxml.jackson.databind.deser.impl.*;
import com.fasterxml.jackson.databind.deser.std.ThrowableDeserializer;
import com.fasterxml.jackson.databind.introspect.*;
import com.fasterxml.jackson.databind.jsontype.TypeDeserializer;
import com.fasterxml.jackson.databind.util.ArrayBuilders;
import com.fasterxml.jackson.databind.util.ClassUtil;
import com.fasterxml.jackson.databind.util.SimpleBeanPropertyDefinition;

/**
 * Concrete deserializer factory class that adds full Bean deserializer
 * construction logic using class introspection.
 * Note that factories specifically do not implement any form of caching:
 * aside from configuration they are stateless; caching is implemented
 * by other components.
 *<p>
 * Instances of this class are fully immutable as all configuration is
 * done by using "fluent factories" (methods that construct new factory
 * instances with different configuration, instead of modifying instance).
 */
public class BeanDeserializerFactory
    extends BasicDeserializerFactory
    implements java.io.Serializable // since 2.1
{
    private static final long serialVersionUID = 1;

    /**
     * Signature of <b>Throwable.initCause</b> method.
     */
    private final static Class<?>[] INIT_CAUSE_PARAMS = new Class<?>[] { Throwable.class };

    private final static Class<?>[] NO_VIEWS = new Class<?>[0];

    /**
     * Set of well-known "nasty classes", deserialization of which is considered dangerous
     * and should (and is) prevented by default.
     */
    private final static Set<String> DEFAULT_NO_DESER_CLASS_NAMES;
    static {
        Set<String> s = new HashSet<String>();
        // Courtesy of [https://github.com/kantega/notsoserial]:
        // (and wrt [databind#1599])
        s.add("org.apache.commons.collections.functors.InvokerTransformer");
        s.add("org.apache.commons.collections.functors.InstantiateTransformer");
        s.add("org.apache.commons.collections4.functors.InvokerTransformer");
        s.add("org.apache.commons.collections4.functors.InstantiateTransformer");
        s.add("org.codehaus.groovy.runtime.ConvertedClosure");
        s.add("org.codehaus.groovy.runtime.MethodClosure");
        s.add("org.springframework.beans.factory.ObjectFactory");
        s.add("com.sun.org.apache.xalan.internal.xsltc.trax.TemplatesImpl");

        // [databind#1737]; JDK provided
        s.add("java.util.logging.FileHandler");
        s.add("java.rmi.server.UnicastRemoteObject");
        // [databind#1737]; 3rd party
        s.add("org.springframework.aop.support.AbstractBeanFactoryPointcutAdvisor");
        s.add("org.springframework.beans.factory.config.PropertyPathFactoryBean");
        s.add("com.mchange.v2.c3p0.JndiRefForwardingDataSource");
        s.add("com.mchange.v2.c3p0.WrapperConnectionPoolDataSource");

        DEFAULT_NO_DESER_CLASS_NAMES = Collections.unmodifiableSet(s);
    }

    /**
     * Set of class names of types that are never to be deserialized.
     */
    private Set<String> _cfgIllegalClassNames = DEFAULT_NO_DESER_CLASS_NAMES;

    /*
    /**********************************************************
    /* Life-cycle
    /**********************************************************
     */

    /**
     * Globally shareable thread-safe instance which has no additional custom deserializers
     * registered
     */
    public final static BeanDeserializerFactory instance = new BeanDeserializerFactory(
            new DeserializerFactoryConfig());

    public BeanDeserializerFactory(DeserializerFactoryConfig config) {
        super(config);
    }

    /**
     * Method used by module registration functionality, to construct a new bean
     * deserializer factory
     * with different configuration settings.
     */
    @Override
    public DeserializerFactory withConfig(DeserializerFactoryConfig config)
    {
        if (_factoryConfig == config) {
            return this;
        }
        /* 22-Nov-2010, tatu: Handling of subtypes is tricky if we do immutable-with-copy-ctor;
         *    and we pretty much have to here either choose between losing subtype instance
         *    when registering additional deserializers, or losing deserializers.
         *    Instead, let's actually just throw an error if this method is called when subtype
         *    has not properly overridden this method; this to indicate problem as soon as possible.
         */
        if (getClass() != BeanDeserializerFactory.class) {
            throw new IllegalStateException("Subtype of BeanDeserializerFactory ("+getClass().getName()
                    +") has not properly overridden method 'withAdditionalDeserializers': can not instantiate subtype with "
                    +"additional deserializer definitions");
        }
        return new BeanDeserializerFactory(config);
    }

    /*
    /**********************************************************
    /* DeserializerFactory API implementation
    /**********************************************************
     */

    /**
     * Method that {@link DeserializerCache}s call to create a new
     * deserializer for types other than Collections, Maps, arrays and
     * enums.
     */
    @Override
    public JsonDeserializer<Object> createBeanDeserializer(DeserializationContext ctxt,
            JavaType type, BeanDescription beanDesc)
        throws JsonMappingException
    {
        final DeserializationConfig config = ctxt.getConfig();
        // We may also have custom overrides:
        JsonDeserializer<Object> custom = _findCustomBeanDeserializer(type, config, beanDesc);
        if (custom != null) {
            return custom;
        }
        /* One more thing to check: do we have an exception type
         * (Throwable or its sub-classes)? If so, need slightly
         * different handling.
         */
        if (type.isThrowable()) {
            return buildThrowableDeserializer(ctxt, type, beanDesc);
        }
        /* Or, for abstract types, may have alternate means for resolution
         * (defaulting, materialization)
         */
        if (type.isAbstract()) {
            // [JACKSON-41] (v1.6): Let's make it possible to materialize abstract types.
            JavaType concreteType = materializeAbstractType(ctxt, type, beanDesc);
            if (concreteType != null) {
                /* important: introspect actual implementation (abstract class or
                 * interface doesn't have constructors, for one)
                 */
                beanDesc = config.introspect(concreteType);
                return buildBeanDeserializer(ctxt, concreteType, beanDesc);
            }
        }

        // Otherwise, may want to check handlers for standard types, from superclass:
        @SuppressWarnings("unchecked")
        JsonDeserializer<Object> deser = (JsonDeserializer<Object>) findStdDeserializer(ctxt, type, beanDesc);
        if (deser != null) {
            return deser;
        }

        // Otherwise: could the class be a Bean class? If not, bail out
        if (!isPotentialBeanType(type.getRawClass())) {
            return null;
        }
        // For checks like [databind#1599]
        checkIllegalTypes(ctxt, type, beanDesc);
        // Use generic bean introspection to build deserializer
        return buildBeanDeserializer(ctxt, type, beanDesc);
    }

    @Override
    public JsonDeserializer<Object> createBuilderBasedDeserializer(
    		DeserializationContext ctxt, JavaType valueType, BeanDescription beanDesc,
    		Class<?> builderClass)
        throws JsonMappingException
    {
    	// First: need a BeanDescription for builder class
    	JavaType builderType = ctxt.constructType(builderClass);
    	BeanDescription builderDesc = ctxt.getConfig().introspectForBuilder(builderType);
    	return buildBuilderBasedDeserializer(ctxt, valueType, builderDesc);
    }

    /**
     * Method called by {@link BeanDeserializerFactory} to see if there might be a standard
     * deserializer registered for given type.
     */
    protected JsonDeserializer<?> findStdDeserializer(DeserializationContext ctxt,
            JavaType type, BeanDescription beanDesc)
        throws JsonMappingException
    {
        // note: we do NOT check for custom deserializers here, caller has already
        // done that
        JsonDeserializer<?> deser = findDefaultDeserializer(ctxt, type, beanDesc);
        // Also: better ensure these are post-processable?
        if (deser != null) {
            if (_factoryConfig.hasDeserializerModifiers()) {
                for (BeanDeserializerModifier mod : _factoryConfig.deserializerModifiers()) {
                    deser = mod.modifyDeserializer(ctxt.getConfig(), beanDesc, deser);
                }
            }
        }
        return deser;
    }

    protected JavaType materializeAbstractType(DeserializationContext ctxt,
            JavaType type, BeanDescription beanDesc)
        throws JsonMappingException
    {
        final JavaType abstractType = beanDesc.getType();
        // [JACKSON-502]: Now it is possible to have multiple resolvers too,
        //   as they are registered via module interface.
        for (AbstractTypeResolver r : _factoryConfig.abstractTypeResolvers()) {
            JavaType concrete = r.resolveAbstractType(ctxt.getConfig(), abstractType);
            if (concrete != null) {
                return concrete;
            }
        }
        return null;
    }

    /*
    /**********************************************************
    /* Public construction method beyond DeserializerFactory API:
    /* can be called from outside as well as overridden by
    /* sub-classes
    /**********************************************************
     */

    /**
     * Method that is to actually build a bean deserializer instance.
     * All basic sanity checks have been done to know that what we have
     * may be a valid bean type, and that there are no default simple
     * deserializers.
     */
    @SuppressWarnings("unchecked")
    public JsonDeserializer<Object> buildBeanDeserializer(DeserializationContext ctxt,
            JavaType type, BeanDescription beanDesc)
        throws JsonMappingException
    {
        // First: check what creators we can use, if any
        ValueInstantiator valueInstantiator;
        /* 04-Jun-2015, tatu: To work around [databind#636], need to catch the
         *    issue, defer; this seems like a reasonable good place for now.
         *   Note, however, that for non-Bean types (Collections, Maps) this
         *   probably won't work and needs to be added elsewhere.
         */
        try {
            valueInstantiator = findValueInstantiator(ctxt, beanDesc);
        } catch (NoClassDefFoundError error) {
            return new NoClassDefFoundDeserializer<Object>(error);
        }
        BeanDeserializerBuilder builder = constructBeanDeserializerBuilder(ctxt, beanDesc);
        builder.setValueInstantiator(valueInstantiator);
         // And then setters for deserializing from JSON Object
        addBeanProps(ctxt, beanDesc, builder);
        addObjectIdReader(ctxt, beanDesc, builder);

        // managed/back reference fields/setters need special handling... first part
        addReferenceProperties(ctxt, beanDesc, builder);
        addInjectables(ctxt, beanDesc, builder);

        final DeserializationConfig config = ctxt.getConfig();
        // [JACKSON-440]: update builder now that all information is in?
        if (_factoryConfig.hasDeserializerModifiers()) {
            for (BeanDeserializerModifier mod : _factoryConfig.deserializerModifiers()) {
                builder = mod.updateBuilder(config, beanDesc, builder);
            }
        }
        JsonDeserializer<?> deserializer;

        /* 19-Mar-2012, tatu: This check used to be done earlier; but we have to defer
         *   it a bit to collect information on ObjectIdReader, for example.
         */
        if (type.isAbstract() && !valueInstantiator.canInstantiate()) {
            deserializer = builder.buildAbstract();
        } else {
            deserializer = builder.build();
        }

        // [JACKSON-440]: may have modifier(s) that wants to modify or replace serializer we just built:
        if (_factoryConfig.hasDeserializerModifiers()) {
            for (BeanDeserializerModifier mod : _factoryConfig.deserializerModifiers()) {
                deserializer = mod.modifyDeserializer(config, beanDesc, deserializer);
            }
        }
        return (JsonDeserializer<Object>) deserializer;
    }

    /**
     * Method for constructing a bean deserializer that uses specified
     * intermediate Builder for binding data, and construction of the
     * value instance.
     * Note that implementation is mostly copied from the regular
     * BeanDeserializer build method.
     */
    @SuppressWarnings("unchecked")
    protected JsonDeserializer<Object> buildBuilderBasedDeserializer(
    		DeserializationContext ctxt, JavaType valueType, BeanDescription builderDesc)
        throws JsonMappingException
    {
    	// Creators, anyone? (to create builder itself)
        ValueInstantiator valueInstantiator = findValueInstantiator(ctxt, builderDesc);
        final DeserializationConfig config = ctxt.getConfig();
        BeanDeserializerBuilder builder = constructBeanDeserializerBuilder(ctxt, builderDesc);
        builder.setValueInstantiator(valueInstantiator);
         // And then "with methods" for deserializing from JSON Object
        addBeanProps(ctxt, builderDesc, builder);
        addObjectIdReader(ctxt, builderDesc, builder);

        // managed/back reference fields/setters need special handling... first part
        addReferenceProperties(ctxt, builderDesc, builder);
        addInjectables(ctxt, builderDesc, builder);

        JsonPOJOBuilder.Value builderConfig = builderDesc.findPOJOBuilderConfig();
        final String buildMethodName = (builderConfig == null) ?
                "build" : builderConfig.buildMethodName;

        // and lastly, find build method to use:
        AnnotatedMethod buildMethod = builderDesc.findMethod(buildMethodName, null);
        if (buildMethod != null) { // note: can't yet throw error; may be given build method
            if (config.canOverrideAccessModifiers()) {
            	ClassUtil.checkAndFixAccess(buildMethod.getMember());
            }
        }
        builder.setPOJOBuilder(buildMethod, builderConfig);
        // this may give us more information...
        if (_factoryConfig.hasDeserializerModifiers()) {
            for (BeanDeserializerModifier mod : _factoryConfig.deserializerModifiers()) {
                builder = mod.updateBuilder(config, builderDesc, builder);
            }
        }
        JsonDeserializer<?> deserializer = builder.buildBuilderBased(
        		valueType, buildMethodName);

        // [JACKSON-440]: may have modifier(s) that wants to modify or replace serializer we just built:
        if (_factoryConfig.hasDeserializerModifiers()) {
            for (BeanDeserializerModifier mod : _factoryConfig.deserializerModifiers()) {
                deserializer = mod.modifyDeserializer(config, builderDesc, deserializer);
            }
        }
        return (JsonDeserializer<Object>) deserializer;
    }

    protected void addObjectIdReader(DeserializationContext ctxt,
            BeanDescription beanDesc, BeanDeserializerBuilder builder)
        throws JsonMappingException
    {
        ObjectIdInfo objectIdInfo = beanDesc.getObjectIdInfo();
        if (objectIdInfo == null) {
            return;
        }
        Class<?> implClass = objectIdInfo.getGeneratorType();
        JavaType idType;
        SettableBeanProperty idProp;
        ObjectIdGenerator<?> gen;

        ObjectIdResolver resolver = ctxt.objectIdResolverInstance(beanDesc.getClassInfo(), objectIdInfo);

        // Just one special case: Property-based generator is trickier
        if (implClass == ObjectIdGenerators.PropertyGenerator.class) { // most special one, needs extra work
            PropertyName propName = objectIdInfo.getPropertyName();
            idProp = builder.findProperty(propName);
            if (idProp == null) {
                throw new IllegalArgumentException("Invalid Object Id definition for "
                        +beanDesc.getBeanClass().getName()+": can not find property with name '"+propName+"'");
            }
            idType = idProp.getType();
            gen = new PropertyBasedObjectIdGenerator(objectIdInfo.getScope());
        } else {
            JavaType type = ctxt.constructType(implClass);
            idType = ctxt.getTypeFactory().findTypeParameters(type, ObjectIdGenerator.class)[0];
            idProp = null;
            gen = ctxt.objectIdGeneratorInstance(beanDesc.getClassInfo(), objectIdInfo);
        }
        // also: unlike with value deserializers, let's just resolve one we need here
        JsonDeserializer<?> deser = ctxt.findRootValueDeserializer(idType);
        builder.setObjectIdReader(ObjectIdReader.construct(idType,
                objectIdInfo.getPropertyName(), gen, deser, idProp, resolver));
    }

    @SuppressWarnings("unchecked")
    public JsonDeserializer<Object> buildThrowableDeserializer(DeserializationContext ctxt,
            JavaType type, BeanDescription beanDesc)
        throws JsonMappingException
    {
        final DeserializationConfig config = ctxt.getConfig();
        // first: construct like a regular bean deserializer...
        BeanDeserializerBuilder builder = constructBeanDeserializerBuilder(ctxt, beanDesc);
        builder.setValueInstantiator(findValueInstantiator(ctxt, beanDesc));

        addBeanProps(ctxt, beanDesc, builder);
        // (and assume there won't be any back references)

        // But then let's decorate things a bit
        /* To resolve [JACKSON-95], need to add "initCause" as setter
         * for exceptions (sub-classes of Throwable).
         */
        AnnotatedMethod am = beanDesc.findMethod("initCause", INIT_CAUSE_PARAMS);
        if (am != null) { // should never be null
            SimpleBeanPropertyDefinition propDef = SimpleBeanPropertyDefinition.construct(ctxt.getConfig(), am,
                    new PropertyName("cause"));
            SettableBeanProperty prop = constructSettableProperty(ctxt, beanDesc, propDef,
                    am.getGenericParameterType(0));
            if (prop != null) {
                /* 21-Aug-2011, tatus: We may actually have found 'cause' property
                 *   to set (with new 1.9 code)... but let's replace it just in case,
                 *   otherwise can end up with odd errors.
                 */
                builder.addOrReplaceProperty(prop, true);
            }
        }

        // And also need to ignore "localizedMessage"
        builder.addIgnorable("localizedMessage");
        // [JACKSON-794]: JDK 7 also added "getSuppressed", skip if we have such data:
        builder.addIgnorable("suppressed");
        /* As well as "message": it will be passed via constructor,
         * as there's no 'setMessage()' method
        */
        builder.addIgnorable("message");

        // [JACKSON-440]: update builder now that all information is in?
        if (_factoryConfig.hasDeserializerModifiers()) {
            for (BeanDeserializerModifier mod : _factoryConfig.deserializerModifiers()) {
                builder = mod.updateBuilder(config, beanDesc, builder);
            }
        }
        JsonDeserializer<?> deserializer = builder.build();

        /* At this point it ought to be a BeanDeserializer; if not, must assume
         * it's some other thing that can handle deserialization ok...
         */
        if (deserializer instanceof BeanDeserializer) {
            deserializer = new ThrowableDeserializer((BeanDeserializer) deserializer);
        }

        // [JACKSON-440]: may have modifier(s) that wants to modify or replace serializer we just built:
        if (_factoryConfig.hasDeserializerModifiers()) {
            for (BeanDeserializerModifier mod : _factoryConfig.deserializerModifiers()) {
                deserializer = mod.modifyDeserializer(config, beanDesc, deserializer);
            }
        }
        return (JsonDeserializer<Object>) deserializer;
    }

    /*
    /**********************************************************
    /* Helper methods for Bean deserializer construction,
    /* overridable by sub-classes
    /**********************************************************
     */

    /**
     * Overridable method that constructs a {@link BeanDeserializerBuilder}
     * which is used to accumulate information needed to create deserializer
     * instance.
     */
    protected BeanDeserializerBuilder constructBeanDeserializerBuilder(DeserializationContext ctxt,
            BeanDescription beanDesc) {
        return new BeanDeserializerBuilder(beanDesc, ctxt.getConfig());
    }

    /**
     * Method called to figure out settable properties for the
     * bean deserializer to use.
     *<p>
     * Note: designed to be overridable, and effort is made to keep interface
     * similar between versions.
     */
    protected void addBeanProps(DeserializationContext ctxt,
            BeanDescription beanDesc, BeanDeserializerBuilder builder)
        throws JsonMappingException
    {
        final SettableBeanProperty[] creatorProps =
                builder.getValueInstantiator().getFromObjectArguments(ctxt.getConfig());
        final boolean isConcrete = !beanDesc.getType().isAbstract();

        // Things specified as "ok to ignore"? [JACKSON-77]
        AnnotationIntrospector intr = ctxt.getAnnotationIntrospector();
        boolean ignoreAny = false;
        {
            Boolean B = intr.findIgnoreUnknownProperties(beanDesc.getClassInfo());
            if (B != null) {
                ignoreAny = B.booleanValue();
                builder.setIgnoreUnknownProperties(ignoreAny);
            }
        }
        // Or explicit/implicit definitions?
        Set<String> ignored = ArrayBuilders.arrayToSet(intr.findPropertiesToIgnore(beanDesc.getClassInfo(), false));
        for (String propName : ignored) {
            builder.addIgnorable(propName);
        }
        // Also, do we have a fallback "any" setter?
        AnnotatedMethod anySetter = beanDesc.findAnySetter();
        if (anySetter != null) {
            builder.setAnySetter(constructAnySetter(ctxt, beanDesc, anySetter));
        }
        // NOTE: we do NOT add @JsonIgnore'd properties into blocked ones if there's any-setter
        // Implicit ones via @JsonIgnore and equivalent?
        if (anySetter == null) {
            Collection<String> ignored2 = beanDesc.getIgnoredPropertyNames();
            if (ignored2 != null) {
                for (String propName : ignored2) {
                    // allow ignoral of similarly named JSON property, but do not force;
                    // latter means NOT adding this to 'ignored':
                    builder.addIgnorable(propName);
                }
            }
        }
        final boolean useGettersAsSetters = (ctxt.isEnabled(MapperFeature.USE_GETTERS_AS_SETTERS)
                && ctxt.isEnabled(MapperFeature.AUTO_DETECT_GETTERS));

        // Ok: let's then filter out property definitions
        List<BeanPropertyDefinition> propDefs = filterBeanProps(ctxt,
                beanDesc, builder, beanDesc.findProperties(), ignored);

        // After which we can let custom code change the set
        if (_factoryConfig.hasDeserializerModifiers()) {
            for (BeanDeserializerModifier mod : _factoryConfig.deserializerModifiers()) {
                propDefs = mod.updateProperties(ctxt.getConfig(), beanDesc, propDefs);
            }
        }

        // At which point we still have all kinds of properties; not all with mutators:
        for (BeanPropertyDefinition propDef : propDefs) {
            SettableBeanProperty prop = null;
            /* 18-Oct-2013, tatu: Although constructor parameters have highest precedence,
             *   we need to do linkage (as per [Issue#318]), and so need to start with
             *   other types, and only then create constructor parameter, if any.
             */
            if (propDef.hasSetter()) {
                Type propertyType = propDef.getSetter().getGenericParameterType(0);
                prop = constructSettableProperty(ctxt, beanDesc, propDef, propertyType);
            } else if (propDef.hasField()) {
                Type propertyType = propDef.getField().getGenericType();
                prop = constructSettableProperty(ctxt, beanDesc, propDef, propertyType);
            } else if (useGettersAsSetters && propDef.hasGetter()) {
                /* As per [JACKSON-88], may also need to consider getters
                 * for Map/Collection properties; but with lowest precedence
                 */
                AnnotatedMethod getter = propDef.getGetter();
                // should only consider Collections and Maps, for now?
                Class<?> rawPropertyType = getter.getRawType();
                if (Collection.class.isAssignableFrom(rawPropertyType)
                        || Map.class.isAssignableFrom(rawPropertyType)) {
                    prop = constructSetterlessProperty(ctxt, beanDesc, propDef);
                }
            }
            // 25-Sep-2014, tatu: No point in finding constructor parameters for abstract types
            //   (since they are never used anyway)
            if (isConcrete && propDef.hasConstructorParameter()) {
                /* [JACKSON-700] If property is passed via constructor parameter, we must
                 *   handle things in special way. Not sure what is the most optimal way...
                 *   for now, let's just call a (new) method in builder, which does nothing.
                 */
                // but let's call a method just to allow custom builders to be aware...
                final String name = propDef.getName();
                CreatorProperty cprop = null;
                if (creatorProps != null) {
                    for (SettableBeanProperty cp : creatorProps) {
                        if (name.equals(cp.getName()) && (cp instanceof CreatorProperty)) {
                            cprop = (CreatorProperty) cp;
                            break;
                        }
                    }
                }
                if (cprop == null) {
                    throw ctxt.mappingException("Could not find creator property with name '%s' (in class %s)",
                            name, beanDesc.getBeanClass().getName());
                }
                if (prop != null) {
                    cprop.setFallbackSetter(prop);
                }
                prop = cprop;
                builder.addCreatorProperty(cprop);
                continue;
            }

            if (prop != null) {
                Class<?>[] views = propDef.findViews();
                if (views == null) {
                    // one more twist: if default inclusion disabled, need to force empty set of views
                    if (!ctxt.isEnabled(MapperFeature.DEFAULT_VIEW_INCLUSION)) {
                        views = NO_VIEWS;
                    }
                }
                // one more thing before adding to builder: copy any metadata
                prop.setViews(views);
                builder.addProperty(prop);
            }
        }
    }

    /**
     * Helper method called to filter out explicit ignored properties,
     * as well as properties that have "ignorable types".
     * Note that this will not remove properties that have no
     * setters.
     */
    protected List<BeanPropertyDefinition> filterBeanProps(DeserializationContext ctxt,
            BeanDescription beanDesc, BeanDeserializerBuilder builder,
            List<BeanPropertyDefinition> propDefsIn,
            Set<String> ignored)
        throws JsonMappingException
    {
        ArrayList<BeanPropertyDefinition> result = new ArrayList<BeanPropertyDefinition>(
                Math.max(4, propDefsIn.size()));
        HashMap<Class<?>,Boolean> ignoredTypes = new HashMap<Class<?>,Boolean>();
        // These are all valid setters, but we do need to introspect bit more
        for (BeanPropertyDefinition property : propDefsIn) {
            String name = property.getName();
            if (ignored.contains(name)) { // explicit ignoral using @JsonIgnoreProperties needs to block entries
                continue;
            }
            if (!property.hasConstructorParameter()) { // never skip constructor params
                Class<?> rawPropertyType = null;
                if (property.hasSetter()) {
                    rawPropertyType = property.getSetter().getRawParameterType(0);
                } else if (property.hasField()) {
                    rawPropertyType = property.getField().getRawType();
                }

                // [JACKSON-429] Some types are declared as ignorable as well
                if ((rawPropertyType != null)
                        && (isIgnorableType(ctxt.getConfig(), beanDesc, rawPropertyType, ignoredTypes))) {
                    // important: make ignorable, to avoid errors if value is actually seen
                    builder.addIgnorable(name);
                    continue;
                }
            }
            result.add(property);
        }
        return result;
    }

    /**
     * Method that will find if bean has any managed- or back-reference properties,
     * and if so add them to bean, to be linked during resolution phase.
     */
    protected void addReferenceProperties(DeserializationContext ctxt,
            BeanDescription beanDesc, BeanDeserializerBuilder builder)
        throws JsonMappingException
    {
        // and then back references, not necessarily found as regular properties
        Map<String,AnnotatedMember> refs = beanDesc.findBackReferenceProperties();
        if (refs != null) {
            for (Map.Entry<String, AnnotatedMember> en : refs.entrySet()) {
                String name = en.getKey();
                AnnotatedMember m = en.getValue();
                Type genericType;
                if (m instanceof AnnotatedMethod) {
                    genericType = ((AnnotatedMethod) m).getGenericParameterType(0);
                } else {
                    genericType = m.getRawType();
                }
                SimpleBeanPropertyDefinition propDef = SimpleBeanPropertyDefinition.construct(
                		ctxt.getConfig(), m);
                builder.addBackReferenceProperty(name, constructSettableProperty(
                        ctxt, beanDesc, propDef, genericType));
            }
        }
    }

    /**
     * Method called locate all members used for value injection (if any),
     * constructor {@link com.fasterxml.jackson.databind.deser.impl.ValueInjector} instances, and add them to builder.
     */
    protected void addInjectables(DeserializationContext ctxt,
            BeanDescription beanDesc, BeanDeserializerBuilder builder)
        throws JsonMappingException
    {
        Map<Object, AnnotatedMember> raw = beanDesc.findInjectables();
        if (raw != null) {
            boolean fixAccess = ctxt.canOverrideAccessModifiers();
            for (Map.Entry<Object, AnnotatedMember> entry : raw.entrySet()) {
                AnnotatedMember m = entry.getValue();
                if (fixAccess) {
                    m.fixAccess(); // to ensure we can call it
                }
                builder.addInjectable(PropertyName.construct(m.getName()),
                        beanDesc.resolveType(m.getGenericType()),
                        beanDesc.getClassAnnotations(), m, entry.getKey());
            }
        }
    }

    /**
     * Method called to construct fallback {@link SettableAnyProperty}
     * for handling unknown bean properties, given a method that
     * has been designated as such setter.
     */
    protected SettableAnyProperty constructAnySetter(DeserializationContext ctxt,
            BeanDescription beanDesc, AnnotatedMethod setter)
        throws JsonMappingException
    {
        if (ctxt.canOverrideAccessModifiers()) {
            setter.fixAccess(); // to ensure we can call it
        }
        // we know it's a 2-arg method, second arg is the value
        JavaType type = beanDesc.bindingsForBeanType().resolveType(setter.getGenericParameterType(1));
        BeanProperty.Std property = new BeanProperty.Std(PropertyName.construct(setter.getName()),
                type, null, beanDesc.getClassAnnotations(), setter,
                PropertyMetadata.STD_OPTIONAL);
        type = resolveType(ctxt, beanDesc, type, setter);

        /* AnySetter can be annotated with @JsonClass (etc) just like a
         * regular setter... so let's see if those are used.
         * Returns null if no annotations, in which case binding will
         * be done at a later point.
         */
        JsonDeserializer<Object> deser = findDeserializerFromAnnotation(ctxt, setter);
        /* Otherwise, method may specify more specific (sub-)class for
         * value (no need to check if explicit deser was specified):
         */
        type = modifyTypeByAnnotation(ctxt, setter, type);
        if (deser == null) {
            deser = type.getValueHandler();
        }
        TypeDeserializer typeDeser = type.getTypeHandler();
        return new SettableAnyProperty(property, setter, type,
                deser, typeDeser);
    }

    /**
     * Method that will construct a regular bean property setter using
     * the given setter method.
     *
     * @return Property constructed, if any; or null to indicate that
     *   there should be no property based on given definitions.
     */
    protected SettableBeanProperty constructSettableProperty(DeserializationContext ctxt,
            BeanDescription beanDesc, BeanPropertyDefinition propDef,
            Type jdkType)
        throws JsonMappingException
    {
        // need to ensure method is callable (for non-public)
        AnnotatedMember mutator = propDef.getNonConstructorMutator();
        if (ctxt.canOverrideAccessModifiers()) {
            mutator.fixAccess();
        }
        // note: this works since we know there's exactly one argument for methods
        JavaType t0 = beanDesc.resolveType(jdkType);

        BeanProperty.Std property = new BeanProperty.Std(propDef.getFullName(),
                t0, propDef.getWrapperName(),
                beanDesc.getClassAnnotations(), mutator, propDef.getMetadata());
        JavaType type = resolveType(ctxt, beanDesc, t0, mutator);
        // did type change?
        if (type != t0) {
            property = property.withType(type);
        }

        /* First: does the Method specify the deserializer to use?
         * If so, let's use it.
         */
        JsonDeserializer<Object> propDeser = findDeserializerFromAnnotation(ctxt, mutator);
        type = modifyTypeByAnnotation(ctxt, mutator, type);
        TypeDeserializer typeDeser = type.getTypeHandler();
        SettableBeanProperty prop;
        if (mutator instanceof AnnotatedMethod) {
            prop = new MethodProperty(propDef, type, typeDeser,
                beanDesc.getClassAnnotations(), (AnnotatedMethod) mutator);
        } else {
            prop = new FieldProperty(propDef, type, typeDeser,
                    beanDesc.getClassAnnotations(), (AnnotatedField) mutator);
        }
        if (propDeser != null) {
            prop = prop.withValueDeserializer(propDeser);
        }
        // [JACKSON-235]: need to retain name of managed forward references:
        AnnotationIntrospector.ReferenceProperty ref = propDef.findReferenceType();
        if (ref != null && ref.isManagedReference()) {
            prop.setManagedReferenceName(ref.getName());
        }
        ObjectIdInfo objectIdInfo = propDef.findObjectIdInfo();
        if(objectIdInfo != null){
            prop.setObjectIdInfo(objectIdInfo);
        }
        return prop;
    }

    /**
     * Method that will construct a regular bean property setter using
     * the given setter method.
     */
    protected SettableBeanProperty constructSetterlessProperty(DeserializationContext ctxt,
            BeanDescription beanDesc, BeanPropertyDefinition propDef)
        throws JsonMappingException
    {
        final AnnotatedMethod getter = propDef.getGetter();
        // need to ensure it is callable now:
        if (ctxt.canOverrideAccessModifiers()) {
            getter.fixAccess();
        }

        /* 26-Jan-2012, tatu: Alas, this complication is still needed to handle
         *   (or at least work around) local type declarations...
         */
        JavaType type = getter.getType(beanDesc.bindingsForBeanType());
        /* First: does the Method specify the deserializer to use?
         * If so, let's use it.
         */
        JsonDeserializer<Object> propDeser = findDeserializerFromAnnotation(ctxt, getter);
        type = modifyTypeByAnnotation(ctxt, getter, type);
        // As per [Issue#501], need full resolution:
        type = resolveType(ctxt, beanDesc, type, getter);
        TypeDeserializer typeDeser = type.getTypeHandler();
        SettableBeanProperty prop = new SetterlessProperty(propDef, type, typeDeser,
                beanDesc.getClassAnnotations(), getter);
        if (propDeser != null) {
            prop = prop.withValueDeserializer(propDeser);
        }
        return prop;
    }

    /*
    /**********************************************************
    /* Helper methods for Bean deserializer, other
    /**********************************************************
     */

    /**
     * Helper method used to skip processing for types that we know
     * can not be (i.e. are never consider to be) beans:
     * things like primitives, Arrays, Enums, and proxy types.
     *<p>
     * Note that usually we shouldn't really be getting these sort of
     * types anyway; but better safe than sorry.
     */
    protected boolean isPotentialBeanType(Class<?> type)
    {
        String typeStr = ClassUtil.canBeABeanType(type);
        if (typeStr != null) {
            throw new IllegalArgumentException("Can not deserialize Class "+type.getName()+" (of type "+typeStr+") as a Bean");
        }
        if (ClassUtil.isProxyType(type)) {
            throw new IllegalArgumentException("Can not deserialize Proxy class "+type.getName()+" as a Bean");
        }
        /* also: can't deserialize some local classes: static are ok; in-method not;
         * and with [JACKSON-594], other non-static inner classes are ok
         */
        typeStr = ClassUtil.isLocalType(type, true);
        if (typeStr != null) {
            throw new IllegalArgumentException("Can not deserialize Class "+type.getName()+" (of type "+typeStr+") as a Bean");
        }
        return true;
    }

    /**
     * Helper method that will check whether given raw type is marked as always ignorable
     * (for purpose of ignoring properties with type)
     */
    protected boolean isIgnorableType(DeserializationConfig config, BeanDescription beanDesc,
            Class<?> type, Map<Class<?>,Boolean> ignoredTypes)
    {
        Boolean status = ignoredTypes.get(type);
        if (status != null) {
            return status.booleanValue();
        }
        BeanDescription desc = config.introspectClassAnnotations(type);
        status = config.getAnnotationIntrospector().isIgnorableType(desc.getClassInfo());
        // We default to 'false', i.e. not ignorable
        return (status == null) ? false : status.booleanValue();
    }

    private void checkIllegalTypes(DeserializationContext ctxt, JavaType type,
            BeanDescription beanDesc)
        throws JsonMappingException
    {
        // There are certain nasty classes that could cause problems, mostly
        // via default typing -- catch them here.
        String full = type.getRawClass().getName();

        if (_cfgIllegalClassNames.contains(full)) {
            String message = String.format("Illegal type (%s) to deserialize: prevented for security reasons",
                    full);
            throw ctxt.mappingException("Invalid type definition for type %s: %s",
                    beanDesc, message);
        }
    }
}

Output:
【漏洞类型】反序列化漏洞
【严重性】High
【漏洞摘要】在这段代码中，`BeanDeserializerFactory`类用于创建Java类的JSON反序列化器。`DEFAULT_NO_DESER_CLASS_NAMES`集合中列出了某些类，这些类在反序列化时被认为是不安全的，并被阻止。然而，这个集合没有包含所有的不安全类。如果攻击者能够控制输入的JSON数据，并且这个数据尝试反序列化这些未被阻止的类，那么可能会导致安全问题，例如远程代码执行（RCE）。根本原因是`DEFAULT_NO_DESER_CLASS_NAMES`集合没有被完整地更新，以包含所有的不安全类。
【关键代码模式】`DEFAULT_NO_DESER_CLASS_NAMES`集合的定义和使用。`createBeanDeserializer`和`buildThrowableDeserializer`方法中的`checkIllegalTypes`调用。
【修复方法说明】修复方法通过在`DEFAULT_NO_DESER_CLASS_NAMES`集合中添加更多的不安全类来解决问题。这有助于防止攻击者利用这些类进行反序列化攻击。最佳实践是定期更新不安全类的列表，并确保在反序列化过程中对所有可能的攻击进行防护。