Skip to content

Ignore static fields in JSONObject.fromJson()#1044

Merged
stleary merged 2 commits intostleary:masterfrom
yuki-matsuhashi:1043-ignore-static
Mar 16, 2026
Merged

Ignore static fields in JSONObject.fromJson()#1044
stleary merged 2 commits intostleary:masterfrom
yuki-matsuhashi:1043-ignore-static

Conversation

@yuki-matsuhashi
Copy link
Contributor

Fixes #1043

This PR updates JSONObject#fromJson(Class<T>) to bind only instance fields.

Changes in this PR:

  • skip static fields
  • add a regression test
  • update the Javadoc

@sonarqubecloud
Copy link

@stleary
Copy link
Owner

stleary commented Mar 13, 2026

What problem does this code solve?
fromJson() should not populate static class fields

Does the code still compile with Java6?
Yes

Risks
Low

Changes to the API?
No

Will this require a new release?
No

Should the documentation be updated?
No, JavaDoc was updated

Does it break the unit tests?
No, and a new unit test was added

Was any code refactored in this commit?
No

Review status
APPROVED

Starting 3-day comment window

@stleary stleary merged commit b959027 into stleary:master Mar 16, 2026
9 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Potentially unsafe deserialization in JSONObject#fromJson() static fields are not excluded

2 participants