{"record":{"id":"5040ea47980f7683","repo":"Anuken/Mindustry","slug":"resolving-arbitrary-classes-classname-is-not","errorCode":null,"errorMessage":"Resolving arbitrary classes (${className}) is not allowed. Use short names for classes only (without the package prefix).","messagePattern":"Resolving arbitrary classes \\((.+?)\\) is not allowed\\. Use short names for classes only \\(without the package prefix\\)\\.","errorType":"validation","errorClass":"SerializationException","httpStatus":null,"severity":"error","filePath":"core/src/mindustry/mod/ContentParser.java","lineNumber":417,"sourceCode":"        });\n    }};\n    /** Stores things that need to be parsed fully, e.g. reading fields of content.\n     * This is done to accommodate binding of content names first.*/\n    private Seq<Runnable> reads = new Seq<>();\n    private Seq<Runnable> postreads = new Seq<>();\n    private ObjectSet<Object> toBeParsed = new ObjectSet<>();\n\n    @Nullable LoadedMod currentMod;\n    @Nullable Content currentContent;\n    @Nullable Fi currentFile;\n\n    private Json parser = new Json(){\n        @Override\n        protected <T> Class<T> resolveClass(String className){\n            if(allowClassResolution){\n                return super.resolveClass(className);\n            }else{\n                throw new SerializationException(\"Resolving arbitrary classes (\" + className + \") is not allowed. Use short names for classes only (without the package prefix).\");\n            }\n        }\n\n        @Override\n        protected Object newInstance(Class type){\n            Object o = super.newInstance(type);\n            onNewInstance(o, type);\n            return o;\n        }\n\n        @Override\n        public <T> T readValue(Class<T> type, Class elementType, JsonValue jsonData, Class keyType){\n            T t = internalRead(type, elementType, jsonData, keyType);\n            if(t != null && !Reflect.isWrapper(t.getClass()) && (type == null || !type.isPrimitive())){\n                checkNullFields(t);\n                if(jsonData.isObject()){\n                    listeners.each(hook -> hook.parsed(type, jsonData, t));\n                }","sourceCodeStart":399,"sourceCodeEnd":435,"githubUrl":"https://github.com/Anuken/Mindustry/blob/f695ad7e60323ebced984fa26d0bcf0bc54296b4/core/src/mindustry/mod/ContentParser.java#L399-L435","documentation":"Thrown by the JSON parser's resolveClass override when allowClassResolution is false and libgdx attempts to resolve a fully-qualified class name from JSON. This is a deliberate security guard preventing arbitrary class instantiation from untrusted mod JSON.","triggerScenarios":"A mod JSON contains a fully-qualified (package-prefixed) class name in a context where libgdx tries to resolve a class, while allowClassResolution is disabled (the default for mod content).","commonSituations":"Author writes full package paths (e.g. mindustry.gen.Bullet), ports content expecting automatic class resolution, or supplies JSON crafted to instantiate arbitrary classes.","solutions":["Use short class names only, without the package prefix.","Register the intended type through the proper parser `put(...)` mapping instead of relying on resolution.","Do not enable allowClassResolution for untrusted content."],"exampleFix":"// before\n\"type\": \"mindustry.gen.Bullet\"\n// after\n\"type\": \"Bullet\"   // short name only","handlingStrategy":"validation","validationCode":"// Reject fully-qualified class names in mod JSON before resolution.\nboolean isShortName(String className) {\n    return className != null && !className.contains(\".\");\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Use short class names only; never include package prefixes.","Do not enable allowClassResolution for untrusted content.","Register custom types via ContentParser.put rather than relying on resolution."],"tags":["modding","json","security","serialization","class-resolution"],"backgroundTag":null,"analyzedSha":"f695ad7e60323ebced984fa26d0bcf0bc54296b4","analyzedAt":"2026-08-14T04:31:16.262Z","schemaVersion":2},"datasetVersion":"2026-08-14T05:17:29.042Z"}