Skip to content

Lock down lenient scalar coercion in the default Jackson ObjectMapper #24

Description

@OmarAlJarrah

Problem

The default mapper only disables FAIL_ON_UNKNOWN_PROPERTIES (JacksonObjectMappers.kt:49-63). A wire string "5" silently coerces into a numeric field, masking malformed payloads.

Proposed change

Configure withCoercionConfig(...) to Fail on mismatched input shapes and disable(MapperFeature.ALLOW_COERCION_OF_SCALARS). Keep this in the Jackson adapter, not sdk-core. Do not disable the AUTO_DETECT_* features — we rely on auto-detected Kotlin data-class binding (defer any tightening to codegen, which controls its own mapper). Pre-1.0 behaviour change.

Prior art: openai-java's ObjectMappers sets per-type coercion to Fail and disables scalar coercion (Apache-2.0 — re-implement, don't copy).

Acceptance

  • "5" → numeric field fails instead of coercing
  • Existing data-class binding still works
  • Tests

Priority: high · Effort: small

Metadata

Metadata

Assignees

No one assigned

    Labels

    enhancementNew feature or requestsdk-coresdk-core toolkit

    Type

    No type

    Fields

    No fields configured for issues without a type.

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions