Merge pull request #788 from sharanggupta/fix-609-array-into-string

Fix #609: Reject a JSON array or object where a value is expected

src/main/java/org/eclipse/yasson/internal/deserializer/PositionChecker.java

diff --git a/src/main/java/org/eclipse/yasson/internal/deserializer/PositionChecker.java b/src/main/java/org/eclipse/yasson/internal/deserializer/PositionChecker.java
index 1668395..2b6f6e9 100644
--- a/src/main/java/org/eclipse/yasson/internal/deserializer/PositionChecker.java
+++ b/src/main/java/org/eclipse/yasson/internal/deserializer/PositionChecker.java
@@ -1,5 +1,6 @@
 /*
  * Copyright (c) 2021, 2023 Oracle and/or its affiliates. All rights reserved.
+ * Copyright (c) 2026 Contributors to the Eclipse Foundation
  *
  * This program and the accompanying materials are made available under the
  * terms of the Eclipse Public License v. 2.0 which is available at
@@ -29,6 +30,7 @@
  * <br>
  * Checks whether json parser is in expected state. If not it will try to skip to the next event, since
  * if user defined components are involved, it is possible to expect incorrect states in terms of the last expected events.
+ * It does not skip into an array or an object which is not expected, since its content would be read as a different type.
  * If this checker is still not in expected state, an exception is thrown.
  */
 public class PositionChecker implements ModelDeserializer<JsonParser> {
@@ -74,7 +76,9 @@
         Event original = value.currentEvent();
         Event startEvent = original;
         if (!expectedEvents.contains(startEvent)) {
-            startEvent = value.next();
+            if (!CLOSING_EVENTS.containsKey(original)) {
+                startEvent = value.next();
+            }
             if (!expectedEvents.contains(startEvent)) {
                 throw new JsonbException("Incorrect position for processing type: " + rType + ". "
                                                  + "Received event: " + original + " "

src/test/java/org/eclipse/yasson/defaultmapping/specific/UnmarshallingUnsupportedTypesTest.java

diff --git a/src/test/java/org/eclipse/yasson/defaultmapping/specific/UnmarshallingUnsupportedTypesTest.java b/src/test/java/org/eclipse/yasson/defaultmapping/specific/UnmarshallingUnsupportedTypesTest.java
index afd68ba..40ecb6d 100644
--- a/src/test/java/org/eclipse/yasson/defaultmapping/specific/UnmarshallingUnsupportedTypesTest.java
+++ b/src/test/java/org/eclipse/yasson/defaultmapping/specific/UnmarshallingUnsupportedTypesTest.java
@@ -1,5 +1,6 @@
 /*
  * Copyright (c) 2015, 2026 Oracle and/or its affiliates. All rights reserved.
+ * Copyright (c) 2026 Contributors to the Eclipse Foundation
  *
  * This program and the accompanying materials are made available under the
  * terms of the Eclipse Public License v. 2.0 which is available at
@@ -118,6 +119,41 @@
         assertFail(json, SupportedTypes.class, "nestedPojo", NestedPojo.class);
     }
 
+    @Test
+    public void testPojoAsArrayOfPojos() {
+        //wrong, nestedPojo is an object, not an array of objects.
+        String json  = "{\"nestedPojo\":[{\"integerValue\":10}],\"optionalLong\":11}";
+        assertFail(json, SupportedTypes.class, "nestedPojo", NestedPojo.class);
+    }
+
+    @Test
+    public void testIntegerAsArray() {
+        // wrong: 'integerValue' field is an Integer, not an array
+        String json  = "{\"nestedPojo\":{\"integerValue\":[10,11]},\"optionalLong\":11}";
+        assertFail(json, SupportedTypes.class, "integerValue", Integer.class);
+    }
+
+    @Test
+    public void testStringAsArray() {
+        // wrong: 'value' field is a String, not an array
+        String json  = "{\"value\":[\"data1\",\"data2\"]}";
+        assertFail(json, new TestTypeToken<ScalarValueWrapper<String>>() { }.getType(), "value", String.class);
+    }
+
+    @Test
+    public void testStringAsObject() {
+        // wrong: 'value' field is a String, not an object.
+        String json  = "{\"value\":{\"nested\":\"data\"}}";
+        assertFail(json, new TestTypeToken<ScalarValueWrapper<String>>() { }.getType(), "value", String.class);
+    }
+
+    @Test
+    public void testIntegerAsObject() {
+        // wrong: 'integerValue' field is an Integer, not an object.
+        String json  = "{\"nestedPojo\":{\"integerValue\":{\"nested\":10}},\"optionalLong\":11}";
+        assertFail(json, SupportedTypes.class, "integerValue", Integer.class);
+    }
+
     @Test()
     public void testMissingFieldDefault() {
         String json  = "{\"nestedPojo\":{\"integerValue\":10,\"missingField\":5},\"optionalLong\":11}";