Check for runtime type assignability during deserialization in RuntimeDelegatingTypeHandler
@@ -134,6 +134,7 @@ public PersistedData serializeNonNull(T value, PersistedDataSerializer serialize
return typeInfo.getRawType();
}
+ @SuppressWarnings({"unchecked"})
@Override
public Optional<T> deserialize(PersistedData data) {
if (!data.isValueMap()) {
@@ -155,6 +156,11 @@ public PersistedData serializeNonNull(T value, PersistedDataSerializer serialize
return Optional.empty();
}
+ if (!typeInfo.getRawType().isAssignableFrom(typeToDeserializeAs.get())) {
+ LOGGER.error("Given type {} is not a sub-type of expected type {}", typeToDeserializeAs.get(), typeInfo.getType());
+ return Optional.empty();
+ }
+
TypeHandler<T> runtimeTypeHandler = (TypeHandler<T>) typeSerializationLibrary.getTypeHandler(typeToDeserializeAs.get(), classLoaders)
// To avoid compile errors in the orElseGet
.map(typeHandler -> (TypeHandler) typeHandler)
