1.java

protected void checkIllegalTypes(DeserializationContext ctxt, JavaType type, BeanDescription beanDesc)
throws JsonMappingException
{
   // There are certain nasty classes that could cause problems, mostly
   // via default typing -- catch them here.
   Class<?> raw = type.getRawClass();
   String name = raw.getSimpleName();

   if ("TemplatesImpl".equals(name)) { // [databind#1599]
     if (raw.getName().startsWith("com.sun.org.apache.xalan")) {
         throw JsonMappingException.from(ctxt,
                       String.format("Illegal type (%s) to deserialize: prevented for security reasons", name));
            }
        }
    }
 }