Tatu Saloranta

@axelczk Please include some kind of reproduction, and perhaps stack trace / exception message. Is the issue with values or key type? And why are you using `readValues()` (or should...

Correct: this is not supported and I am not quite sure how it could be -- it would require transformation of some kind from whatever array type is being used...

The problem is not deserialization as these values can be decoded as values. The problem is that of exposing it via token stream; Object keys are exposed as `JsonToken.FIELD_NAME` for...

Thank you for reporting this issue: sounds like sub-optimal handling. I am not sure I see DoS aspect itself as exceptions are the mechanism to use for many kinds of...

I added a failing unit test for this one, but I do think actual fix needs to go in `ion-java`; Jackson cannot prevent it from being thrown and so any...

Hi @jobarr-amzn! I assume you haven't had a chance to look into this but thought I'd ping just in case.

Unfortunately never looked into this. Assuming you think it is a valid issue (I am not familiar enough with Ion's type system unfortunately), would probably make sense to add test...

This may be difficult to make work reliably, since databinding can not have format-specific handling, and streaming parser (`CBORParser`) has to expose all data using standard `JsonToken` types. But there...

Since tag id is available via `CBORParser`, I think it should be possible and perhaps easy to write custom `JsonDeserializer` implementation that can read `byte[]` from event as well as...

@sbernard31 `CBORParser` does have method `getCurrentTag()` so custom deserializer could work, but there is no automated support for general databinding.