@@ -3376,13 +3376,20 @@ public static <T> T fromJson(String jsonString, Class<T> clazz) {
33763376 * Deserializes a JSON string into an instance of the specified class.
33773377 *
33783378 * <p>This method attempts to map JSON key-value pairs to the corresponding fields
3379- * of the given class. It supports basic data types including int, double, float,
3380- * long, and boolean (as well as their boxed counterparts). The class must have a
3381- * no-argument constructor, and the field names in the class must match the keys
3382- * in the JSON string.
3379+ * of the given class. It supports basic data types including {@code int}, {@code double},
3380+ * {@code float}, {@code long}, and {@code boolean}, as well as their boxed counterparts.
3381+ * The target class must have a no-argument constructor, and its field names must match
3382+ * the keys in the JSON string.
3383+ *
3384+ * <p><strong>Note:</strong> Only classes that are explicitly supported and registered within
3385+ * the {@code JSONObject} context can be deserialized. If the provided class is not among those,
3386+ * this method will not be able to deserialize it. This ensures that only a limited and
3387+ * controlled set of types can be instantiated from JSON for safety and predictability.
33833388 *
33843389 * @param clazz the class of the object to be returned
3385- * @return an instance of type T with fields populated from the JSON string
3390+ * @param <T> the type of the object
3391+ * @return an instance of type {@code T} with fields populated from the JSON string
3392+ * @throws IllegalArgumentException if the class is not supported for deserialization
33863393 */
33873394 @ SuppressWarnings ("unchecked" )
33883395 public <T > T fromJson (Class <T > clazz ) {
0 commit comments