1 files changed, 38 insertions, 0 deletions
diff --git a/eaaf_core/src/main/java/at/gv/egiz/eaaf/core/impl/utils/DefaultYamlMapper.java b/eaaf_core/src/main/java/at/gv/egiz/eaaf/core/impl/utils/DefaultYamlMapper.java
new file mode 100644
index 00000000..6e8c4540
--- /dev/null
+++ b/eaaf_core/src/main/java/at/gv/egiz/eaaf/core/impl/utils/DefaultYamlMapper.java
@@ -0,0 +1,38 @@
+package at.gv.egiz.eaaf.core.impl.utils;
+
+import com.fasterxml.jackson.annotation.JsonAutoDetect.Visibility;
+import com.fasterxml.jackson.annotation.PropertyAccessor;
+import com.fasterxml.jackson.databind.DeserializationFeature;
+import com.fasterxml.jackson.databind.ObjectMapper;
+import com.fasterxml.jackson.dataformat.yaml.YAMLFactory;
+import lombok.Getter;
+
+/**
+ * Holder for Jackson JSON Mapper that sets some security features.
+ *
+ * @author tlenz
+ *
+ */
+public final class DefaultYamlMapper {
+
+  @Getter
+  private static final ObjectMapper yamlMapper = new ObjectMapper(new YAMLFactory());
+
+  static {
+    // initialize JSON Mapper
+    yamlMapper.configure(DeserializationFeature.FAIL_ON_READING_DUP_TREE_KEY, true);
+    yamlMapper.configure(DeserializationFeature.FAIL_ON_TRAILING_TOKENS, true);
+    yamlMapper.configure(DeserializationFeature.FAIL_ON_UNKNOWN_PROPERTIES, true);
+    yamlMapper.setVisibility(PropertyAccessor.ALL, Visibility.NONE);
+    yamlMapper.setVisibility(PropertyAccessor.GETTER, Visibility.PUBLIC_ONLY);
+    yamlMapper.setVisibility(PropertyAccessor.IS_GETTER, Visibility.PUBLIC_ONLY);
+
+  }
+
+  /**
+   * private constructor for class with only static methods.
+   */
+  private DefaultYamlMapper() {
+
+  }
+}