Improved JSON validation (no trailing data, duplicate check)

backend/molgenis-emx2-graphql/src/main/java/org/molgenis/emx2/graphql/GraphqlCustomTypes.java

@@ -1,17 +1,17 @@
 package org.molgenis.emx2.graphql;
 
 import com.fasterxml.jackson.core.JsonProcessingException;
-import com.fasterxml.jackson.databind.ObjectMapper;
 import graphql.schema.*;
 import jakarta.servlet.http.Part;
 import java.io.ByteArrayOutputStream;
 import java.io.IOException;
 import java.io.InputStream;
 import java.util.Map;
 import org.molgenis.emx2.BinaryFileWrapper;
+import org.molgenis.emx2.utils.MolgenisObjectMapper;
 
 public class GraphqlCustomTypes {
-  private static final ObjectMapper objectMapper = new ObjectMapper();
+  private static final MolgenisObjectMapper objectMapper = MolgenisObjectMapper.INTERNAL;
 
   private GraphqlCustomTypes() {
     // hide constructor
@@ -28,7 +28,7 @@ private GraphqlCustomTypes() {
                 public String serialize(Object dataFetcherResult) {
                   // Convert Java object to JSON string
                   try {
-                    return objectMapper.writeValueAsString(dataFetcherResult);
+                    return objectMapper.getWriter().writeValueAsString(dataFetcherResult);
                   } catch (JsonProcessingException e) {
                     throw new CoercingSerializeException(
                         "Unable to serialize to JSON string: " + e.getMessage());

backend/molgenis-emx2/src/main/java/org/molgenis/emx2/utils/MolgenisObjectMapper.java

@@ -0,0 +1,74 @@
+package org.molgenis.emx2.utils;
+
+import com.fasterxml.jackson.core.JsonParser;
+import com.fasterxml.jackson.core.JsonProcessingException;
+import com.fasterxml.jackson.core.StreamReadFeature;
+import com.fasterxml.jackson.databind.DeserializationFeature;
+import com.fasterxml.jackson.databind.JsonNode;
+import com.fasterxml.jackson.databind.ObjectMapper;
+import com.fasterxml.jackson.databind.ObjectReader;
+import com.fasterxml.jackson.databind.ObjectWriter;
+import org.molgenis.emx2.MolgenisException;
+
+public enum MolgenisObjectMapper {
+  INTERNAL {
+    @Override
+    void configureSpecific(ObjectMapper objectMapper) {
+      // Enable source inclusion in error location
+      objectMapper.configure(StreamReadFeature.INCLUDE_SOURCE_IN_LOCATION.mappedFeature(), true);
+    }
+  },
+  PUBLIC;
+
+  // Immutable singletons
+  private ObjectReader reader;
+  private ObjectWriter writer;
+
+  public ObjectReader getReader() {
+    return reader;
+  }
+
+  public ObjectWriter getWriter() {
+    return writer;
+  }
+
+  MolgenisObjectMapper() {
+    ObjectMapper objectMapper = new ObjectMapper();
+    configureGeneric(objectMapper);
+    configureSpecific(objectMapper);
+
+    this.reader = objectMapper.reader();
+    this.writer = objectMapper.writer();
+  }
+
+  private void configureGeneric(ObjectMapper objectMapper) {
+    // No trailing data allowed
+    objectMapper.configure(DeserializationFeature.FAIL_ON_TRAILING_TOKENS, true);
+    // Duplicate check reduces performance
+    objectMapper.configure(JsonParser.Feature.STRICT_DUPLICATE_DETECTION, true);
+  }
+
+  /**
+   * Override for specific configs.
+   */
+  void configureSpecific(ObjectMapper objectMapper) {}
+
+  /**
+   * @see #validate(JsonNode) 
+   */
+  public String validate(String json) throws JsonProcessingException {
+    return validate(reader.readTree(json)).toString();
+  }
+
+  /**
+   * Validate JSON if it adheres to Molgenis EMX2 specific requirements.
+   */
+  public JsonNode validate(JsonNode rootNode) {
+    if (!(rootNode.isObject() || rootNode.isArray())) {
+      throw new MolgenisException(
+              "Only an object or array is allowed as root element. Found type is: "
+                      + rootNode.getNodeType().name());
+    }
+    return rootNode;
+  }
+}

backend/molgenis-emx2/src/main/java/org/molgenis/emx2/utils/TypeUtils.java

@@ -1,9 +1,6 @@
 package org.molgenis.emx2.utils;
 
-import com.fasterxml.jackson.core.StreamReadFeature;
-import com.fasterxml.jackson.databind.DeserializationFeature;
 import com.fasterxml.jackson.databind.JsonNode;
-import com.fasterxml.jackson.databind.ObjectMapper;
 import java.lang.reflect.Array;
 import java.math.BigDecimal;
 import java.sql.Timestamp;
@@ -22,13 +19,7 @@
 import org.molgenis.emx2.*;
 
 public class TypeUtils {
-  private static final ObjectMapper objectMapper = new ObjectMapper();
-
-  static {
-    // Enable source inclusion in error location
-    objectMapper.configure(StreamReadFeature.INCLUDE_SOURCE_IN_LOCATION.mappedFeature(), true);
-    objectMapper.configure(DeserializationFeature.FAIL_ON_TRAILING_TOKENS, true);
-  }
+  private static final MolgenisObjectMapper objectMapper = MolgenisObjectMapper.INTERNAL;
 
   private static final String LOOSE_PARSER_FORMAT =
       "[yyyy-MM-dd]['T'[HHmmss][HHmm][HH:mm:ss][HH:mm][.SSSSSSSSS][.SSSSSSSS][.SSSSSSS][.SSSSSS][.SSSSS][.SSSS][.SSS][.SS][.S]][OOOO][O][z][XXXXX][XXXX]['['VV']']";
@@ -267,7 +258,7 @@ public static JSONB toJsonb(Object v) {
       String value = toString(v);
       if (value != null) {
         try {
-          v = objectMapper.readTree(value);
+          v = objectMapper.getReader().readTree(value);
         } catch (Exception e) {
           throw new MolgenisException("Invalid json", e);
         }
@@ -276,22 +267,13 @@ public static JSONB toJsonb(Object v) {
       }
     }
     if (v instanceof JsonNode) {
-      return org.jooq.JSONB.valueOf(validateJson((JsonNode) v).toString());
+      return org.jooq.JSONB.valueOf(objectMapper.validate((JsonNode) v).toString());
     }
 
     // Other input is invalid (no casting due to ensuring validateJson() is executed).
     throw new ClassCastException("Cannot cast '" + v.toString() + "' to JSONB");
   }
 
-  public static JsonNode validateJson(JsonNode rootNode) throws MolgenisException {
-    if (!(rootNode.isObject() || rootNode.isArray())) {
-      throw new MolgenisException(
-          "Only an object or array is allowed as root element. Found type is: "
-              + rootNode.getNodeType().name());
-    }
-    return rootNode;
-  }
-
   public static String toText(Object v) {
     if (v == null) return null;
     if (v instanceof String) {