Spotbugs + Java: may expose internal representation by storing an externally mutable object into objectMapper

[patpatpat123]

Hello team,

Since this is my first issue from 2025, just wanted to start by wishing you a happy new year and the best for 2025.

Wanted to reach out regarding an issue reported by spot bugs: "may expose internal representation by storing an externally mutable object into objectMapper"

We are using SpringBoot, and in many of our classes, we have this construct:

@Service
public final class SomeService {

    @Autowired ObjectMapper objectMapper;

    public SomeService(...

This would be flagged with

MALICIOUS_CODE	[EI_EXPOSE_REP2](https://spotbugs.readthedocs.io/en/latest/bugDescriptions.html#EI_EXPOSE_REP2)

"may expose internal representation by storing an externally mutable object into objectMapper"

Could you please help fix this vulnerability?

Thank you for your time

[pjfanning]

This issue is not a Jackson issue. It is a problem with your code. Try making the objectMapper private. Contact the spotbugs community to see if they have other suggestions.

[cowtowncoder]

@patpatpat123 Going forward you would want to reach out on Spring Boot forums for issues like this; as @pjfanning suggested this has little to do with Jackson based on output you shared.

[pjfanning]

https://spotbugs.readthedocs.io/en/latest/bugDescriptions.html#ei2-may-expose-internal-representation-by-incorporating-reference-to-mutable-object-ei-expose-rep2

Suggests that it is not a great idea to share an ObjectMapper instance across various classes because one of those might mutate the configuration of the ObjectMapper instance - and this would affect other classes that had access to the same instance.

You would be better off sharing (autowiring) ObjectReader and ObjectWriter instances. This can't be mutated. If you call an API to change the config of an ObjectReader or ObjectWriter, you are returned a new instance that has the modified config.

• https://www.javadoc.io/doc/com.fasterxml.jackson.core/jackson-databind/latest/com/fasterxml/jackson/databind/class-use/ObjectReader.html
• https://www.javadoc.io/doc/com.fasterxml.jackson.core/jackson-databind/latest/com/fasterxml/jackson/databind/class-use/ObjectWriter.html

You may need to update your Dependency Injection code to inject an ObjectReader instance and/or ObjectWriter instance. They can be created using an ObjectMapper instance.

[patpatpat123]

Thank you all for your answers