Switch from Gson LinkedTreeMap
to JDK LinkedHashMap
as Map implementation
#2737
Labels
LinkedTreeMap
to JDK LinkedHashMap
as Map implementation
#2737
Problem solved by the feature
Gson uses its internal
LinkedTreeMap
asMap
implementation when aMap<String, ...>
(or a rawMap
) should be created. The reasons for thisLinkedTreeMap
seem to be that old JDK versions were vulnerable to denial-of-service attacks due to hash code collision. See previous discussions in #1992 (comment) (that also covers another Gson Map implementation which we had removed in the meantime) and #2152 (comment).The problem is that Gson's
LinkedTreeMap
:null
keysComparable
This can cause issues such as #1247, but also for less contrived cases where the user tries to add
null
or non-Comparable
to the deserialized map, such as:Note: I have added the java8Issues related to making Java 8 the minimum supported version
label because for Java >= 8 we can probably be relatively sure that
LinkedTreeMap
is not needed as denial-of-service protection, see JDK-8046170.But we could also already make this change while Gson is still targeting Java 7 as minimum.
Feature description
We should consider not creating Gson's
LinkedTreeMap
inConstructorConstructor
anymore, but only JDKLinkedHashMap
.(And adjust unit tests which assert
isInstanceof(LinkedTreeMap.class)
andisNotInstanceof(LinkedTreeMap.class)
.)Note: We can probably not completely remove
LinkedTreeMap
because:@Deprecated
thoughJsonObject
uses it, and especially itsasMap
method relies onLinkedTreeMap
not permittingnull
keys and valuesOtherwise we would have to write a custom wrapper class which disallows
null
keys and values (similar to what we have forJsonArray#asList
)This would then:
Alternatives / workarounds
ClassCastException
due toLinkedTreeMap
usage, see Fix LinkedTreeMap being used for non-Comparable keys #2152The text was updated successfully, but these errors were encountered: