title: How to I DISABLE DefaultTyping. Is it disabled by default
body: <p>I need to ensure that the application I am writing has no Jackson XML/JSON vulnerabilities (CSV's). All the discussions I have seen talk about how to manage it! I want it OFF.</p>
  
  <p>I am using the latest Jackson version 2.10.0 and the latest Spring boot 2.1.9 and Spring 5.2.0 but I have to justify my use of Jackson and I do not require any polymorphic behaviour.</p>
  
  <p>The doc says I need to use activateDefaultTyping(). This sounds as if it turns it ON. Do I need to use activateDefaultTyping and implement PolymorphicTypeValidator to prevent it? Do I need this to prevent ALL polymorphic behaviour?</p>
  
  <p>I have read lots of articles on managing the behaviour but I am still unclear what the default behaviour is. If it is polymorphic by default I need to turn if OFF.</p>