## Supplementary Knowledge on Fastjson Deserialization

- Both `JSON.parse(jsonString)` and `JSON.parseObject(jsonString, Target.class)` share the same call chain. The former parses the @type-specified class from within jsonString, while the latter directly uses the class from the parameter. Therefore, both are trigger points -- the former triggers directly, while the latter requires that `Target.class` contains fields that need type inference (interfaces or objects, etc.).
- `JSON.parseObject(jsonString)` is a wrapper call around `JSON.parse(jsonString)` and equally has deserialization issues.
