Skip to content

Safer serialization#229

Open
trema96 wants to merge 5 commits intomainfrom
improvement/safer-serialization
Open

Safer serialization#229
trema96 wants to merge 5 commits intomainfrom
improvement/safer-serialization

Conversation

@trema96
Copy link
Contributor

@trema96 trema96 commented Sep 19, 2025

Changes to serialization that should allow for better compatibility with other json serialization libraries

Special floating point numbers

Currently "Infinity" and "NaN"are considered valid values forDoubleandFloat` properties. Disabling this behaviour should be safe since:

  • JSON.stringify by default maps NaN and infinite values to null
  • kotlinx Json serialization fails when serializing NaN or infinite values
  • These values shouldn't be needed in medical context

There seem to be no configuration that allows disabling this behaviour, the only solution is to create custom serializers for these types and registering them on the object mapper.

The serializers introduced with this module will:

  • Cause a 500 error if we ever attempt to serialize NaN or infinite values
  • Cause a 400 error if Float or Double values are encoded as strings in the input json
  • Cause a 400 error if Float or Double are too big and would be decoded as infinity

Notes:

  • Infinity or NaN (unquoted) were already not accepted (by default)
  • The module disables any form of coercion for Double and Float values, regardless of configuration (see Scalar coercion below)

Scalar coercion

Jackson by default has a configuration ALLOW_COERCION_OF_SCALARS which allows parsing without errors also inputs like { "double": "2.0" } or { "double": true }.

This configuration should be disabled in a future update but:

  • It could could be breaking for some users
  • We need to update krouch dependency to not rely on it anymore

TODO Lite / Kmehr

  • The SharedWebConfig.getJackson2JsonEncoder method now takes the object mapper in input. Make sure to use that instead of creating a new one
  • Make sure the mapper used with couchdb is updated too

@trema96 trema96 force-pushed the improvement/safer-serialization branch from c38581a to 90eb30c Compare September 22, 2025 08:12
@trema96 trema96 marked this pull request as ready for review September 22, 2025 11:50
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant