From 04511c4f5332a173f5f917d52cb6833975371e98 Mon Sep 17 00:00:00 2001
From: amontenegro <a.montenegro@orcid.org>
Date: Wed, 7 Oct 2026 15:04:44 -0600
Subject: [PATCH] Allow any know class to be deserialized

---
 .../OrcidBeanClassLoaderAware.java            | 11 +++++++++++
 ...rcidRedisIndexedSessionRepositoryTest.java | 19 +++++++++++++++++++
 2 files changed, 30 insertions(+)

diff --git a/orcid-web/src/main/java/org/orcid/frontend/spring/configuration/OrcidBeanClassLoaderAware.java b/orcid-web/src/main/java/org/orcid/frontend/spring/configuration/OrcidBeanClassLoaderAware.java
index 262b5e1b70f..57547d94e77 100644
--- a/orcid-web/src/main/java/org/orcid/frontend/spring/configuration/OrcidBeanClassLoaderAware.java
+++ b/orcid-web/src/main/java/org/orcid/frontend/spring/configuration/OrcidBeanClassLoaderAware.java
@@ -3,6 +3,7 @@
 import com.fasterxml.jackson.annotation.*;
 import com.fasterxml.jackson.databind.ObjectMapper;
 import com.fasterxml.jackson.databind.annotation.JsonDeserialize;
+import com.fasterxml.jackson.databind.jsontype.BasicPolymorphicTypeValidator;
 import org.orcid.authorization.authentication.MFAWebAuthenticationDetails;
 import org.orcid.frontend.web.util.MFAWebAuthenticationDetailsDeserializer;
 import org.orcid.frontend.web.util.SwitchUserGrantedAuthorityDeserializer;
@@ -34,6 +35,16 @@ private ObjectMapper objectMapper() {
         ObjectMapper mapper = new ObjectMapper();
         mapper.registerModules(SecurityJackson2Modules.getModules(this.loader));
         mapper.registerModules(new CoreJackson2Module());
+        mapper.activateDefaultTyping(
+                BasicPolymorphicTypeValidator.builder()
+                        .allowIfSubType("java.lang")
+                        .allowIfSubType("org.orcid")
+                        .allowIfSubType("org.springframework.security")
+                        .allowIfSubType("jakarta.servlet")
+                        .allowIfSubType("java.util")
+                        .build(),
+                ObjectMapper.DefaultTyping.NON_FINAL,
+                JsonTypeInfo.As.PROPERTY);
         mapper.addMixIn(String[].class, StringArrayMixin.class);
         mapper.addMixIn(SwitchUserGrantedAuthority.class, SwitchUserGrantedAuthorityMixin.class);
         mapper.addMixIn(MFAWebAuthenticationDetails.class, MFAWebAuthenticationDetailsMixin.class);
diff --git a/orcid-web/src/test/java/org/orcid/frontend/spring/session/redis/OrcidRedisIndexedSessionRepositoryTest.java b/orcid-web/src/test/java/org/orcid/frontend/spring/session/redis/OrcidRedisIndexedSessionRepositoryTest.java
index c3084ba9806..2f1640593aa 100644
--- a/orcid-web/src/test/java/org/orcid/frontend/spring/session/redis/OrcidRedisIndexedSessionRepositoryTest.java
+++ b/orcid-web/src/test/java/org/orcid/frontend/spring/session/redis/OrcidRedisIndexedSessionRepositoryTest.java
@@ -17,12 +17,16 @@
 import org.junit.runner.RunWith;
 import org.mockito.Mock;
 import org.mockito.junit.MockitoJUnitRunner;
+import org.orcid.frontend.spring.configuration.OrcidBeanClassLoaderAware;
 import org.springframework.data.redis.core.BoundHashOperations;
 import org.springframework.data.redis.core.BoundSetOperations;
 import org.springframework.data.redis.core.RedisOperations;
+import org.springframework.data.redis.serializer.RedisSerializer;
 import org.springframework.session.FindByIndexNameSessionRepository;
 import org.springframework.web.context.request.RequestContextHolder;
 
+import static org.junit.Assert.assertEquals;
+
 @RunWith(MockitoJUnitRunner.class)
 public class OrcidRedisIndexedSessionRepositoryTest {
 
@@ -83,4 +87,19 @@ public void deleteByIdShouldWorkWithoutHttpRequestContext() {
         verify(principalSetOperations).remove(eq(SESSION_ID));
         verify(expirationSetOperations).remove(eq("expires:" + SESSION_ID));
     }
+
+    @Test
+    public void springSessionSerializerShouldAllowJavaLongsForSessionDelta() {
+        OrcidBeanClassLoaderAware beanClassLoaderAware = new OrcidBeanClassLoaderAware();
+        beanClassLoaderAware.setBeanClassLoader(getClass().getClassLoader());
+
+        RedisSerializer<Object> serializer = beanClassLoaderAware.springSessionDefaultRedisSerializer();
+        Map<String, Object> sessionDelta = new HashMap<>();
+        sessionDelta.put("lastAccessedTime", 123456789L);
+
+        byte[] json = serializer.serialize(sessionDelta);
+        Map<String, Object> deserialized = (Map<String, Object>) serializer.deserialize(json);
+
+        assertEquals(Long.valueOf(123456789L), deserialized.get("lastAccessedTime"));
+    }
 }