configure default PolymorphicTypeValidator in jackson 11

[codingchili]

This is an extra security precaution to block deserialization of classes that specify weakly typed or known vulnerable types.

This will guard against cases where the @JsonTypeInfo annotation is used with JsonTypeInfo.Id.CLASS or when polymorphic types are enabled by an user on the default mapper, used by vert.x, internally and through the Serializer utility. (polymorphic deserialization is disabled by default and not recommended to be enabled.)

Use of Object.class is still allowed without the annotation and without enabling polymorphic types, in this case jackson chooses the implementation class (map, list or basic type) - this is not a security vulnerability and this behavior has not been changed.

See FasterXML/jackson-databind#2587 for list of classes that are blocked.

[codingchili]

Fixed in 4a4ddb0