In the FastjsonSerializer.java file, the deserialize method uses:
Java
JSON.parse(new String(bytes), Feature.SupportAutoType);
The Feature.SupportAutoType flag enables FastJSON's automatic type deserialization, which allows the library to automatically instantiate the correct object types during deserialization based on type information embedded in the JSON.
⚠️ Security Note: This is significant because FastJSON's autoType feature has been a known security vulnerability vector. When enabled, it can potentially allow arbitrary class instantiation through specially crafted JSON payloads, making the application vulnerable to remote code execution if untrusted data is deserialized. This is why many projects and security advisories recommend using autoType cautiously or disabling it in production environments.
In the FastjsonSerializer.java file, the deserialize method uses:
Java
JSON.parse(new String(bytes), Feature.SupportAutoType);
The Feature.SupportAutoType flag enables FastJSON's automatic type deserialization, which allows the library to automatically instantiate the correct object types during deserialization based on type information embedded in the JSON.