Fix #5962: Case-insensitive deserialization may use wrong @JsonIgnoreProperties

Author: cowtowncoder

release-notes/CREDITS

@@ -366,6 +366,9 @@ Omkhar Arasaratnam (@omkhar)
  * Contributed fix for #5958: `@JsonView` ignored with
    `@JsonTypeInfo(include = As.EXTERNAL_PROPERTY)`
   [3.2.0]
+ * Contributed fix for #5962: Case-insensitive deserialization may use
+   wrong `@JsonIgnoreProperties`
+  [3.2.0]
 
 Michael Orzechowski (@MikeBlink)
  * Reported #5941: `MapperBuilder.addModule()` does not recursively register transitive

release-notes/VERSION

@@ -213,6 +213,8 @@ Versions: 3.x (for earlier see VERSION-2.x)
 #5958: `@JsonView` ignored with `@JsonTypeInfo(include = As.EXTERNAL_PROPERTY)`
  (fixed by Omkhar A)
 #5960: Deprecate un-maintained `tools.jackson.databind.jsontype.impl.SubTypeValidator`
+#5962: Case-insensitive deserialization may use wrong `@JsonIgnoreProperties`
+ (fixed by Omkhar A)
 - Remove project-specific Android SDK compatibility level, use shared;
   no change level itself (stillAndroid SDK 34)
 

src/main/java/tools/jackson/databind/deser/bean/BeanDeserializerBase.java

@@ -954,7 +954,10 @@ public ValueDeserializer<?> createContextual(DeserializationContext ctxt,
             // 16-May-2016, tatu: How about per-property case-insensitivity?
             Boolean B = format.getFeature(JsonFormat.Feature.ACCEPT_CASE_INSENSITIVE_PROPERTIES);
             if (B != null) {
-                BeanPropertyMap propsOrig = _beanProperties;
+                // [databind#5962]: must rebuild from the (possibly filtered) contextual
+                // BeanPropertyMap so that per-property @JsonIgnoreProperties exclusions
+                // applied by _handleByNameInclusion() above are preserved.
+                BeanPropertyMap propsOrig = contextual._beanProperties;
                 BeanPropertyMap props = propsOrig.withCaseInsensitivity(B.booleanValue());
                 if (props != propsOrig) {
                     contextual = contextual.withBeanProperties(props);

src/test/java/tools/jackson/databind/deser/filter/IgnorePropertiesCaseInsensitive5962Test.java

@@ -0,0 +1,92 @@
+package tools.jackson.databind.deser.filter;
+
+import org.junit.jupiter.api.Test;
+
+import com.fasterxml.jackson.annotation.JsonFormat;
+import com.fasterxml.jackson.annotation.JsonIgnoreProperties;
+
+import tools.jackson.databind.*;
+import tools.jackson.databind.testutil.DatabindTestUtil;
+
+import static org.junit.jupiter.api.Assertions.*;
+
+/**
+ * [databind#5962]: Case-insensitive BeanPropertyMap rebuild undoes per-property
+ * {@code @JsonIgnoreProperties}.
+ *
+ * {@code BeanDeserializerBase.createContextual()} calls {@code _handleByNameInclusion()}
+ * to filter properties according to per-property {@code @JsonIgnoreProperties}, producing
+ * a contextual deserializer with the restricted {@code BeanPropertyMap}. However, the
+ * subsequent case-insensitivity block read {@code _beanProperties} (the *original*
+ * unfiltered map from {@code this}) rather than {@code contextual._beanProperties} (the
+ * filtered map). {@code withCaseInsensitivity()} then rebuilt the map from the unfiltered
+ * source, and {@code contextual.withBeanProperties(props)} overwrote the filtered map with
+ * the unfiltered one — any properties removed by {@code _handleByNameInclusion} were
+ * restored.
+ *
+ * Patch: source the case-insensitive rebuild from {@code contextual._beanProperties}.
+ */
+public class IgnorePropertiesCaseInsensitive5962Test extends DatabindTestUtil
+{
+    static class AdminDto {
+        public String adminKey = "DEFAULT";
+        public String username;
+    }
+
+    // Container that ignores "adminKey" on the AdminDto field AND enables case-insensitive matching
+    static class Container {
+        @JsonIgnoreProperties("adminKey")
+        @JsonFormat(with = JsonFormat.Feature.ACCEPT_CASE_INSENSITIVE_PROPERTIES)
+        public AdminDto admin;
+    }
+
+    // Baseline container: only @JsonIgnoreProperties, no case-insensitive format override
+    static class BaselineContainer {
+        @JsonIgnoreProperties("adminKey")
+        public AdminDto admin;
+    }
+
+    /**
+     * NEGATIVE CONTROL: without the @JsonFormat case-insensitive override, @JsonIgnoreProperties
+     * correctly suppresses adminKey on the nested AdminDto field.
+     */
+    @Test
+    public void test5962_negativeControl_withoutCaseInsensitivity() throws Exception {
+        ObjectMapper mapper = jsonMapperBuilder().build();
+        String json = "{\"admin\":{\"adminKey\":\"HACKED\",\"username\":\"alice\"}}";
+        BaselineContainer result = mapper.readValue(json, BaselineContainer.class);
+        // Without case-insensitive format, @JsonIgnoreProperties blocks adminKey
+        assertNotEquals("HACKED", result.admin.adminKey,
+                "@JsonIgnoreProperties alone (no case-insensitive format) should block adminKey");
+        assertEquals("alice", result.admin.username);
+    }
+
+    /**
+     * EXPLOIT PATH: the case-insensitive BeanPropertyMap rebuild (triggered by
+     * @JsonFormat ACCEPT_CASE_INSENSITIVE_PROPERTIES) restores the unfiltered original
+     * _beanProperties, undoing the @JsonIgnoreProperties("adminKey") exclusion.
+     * Case-insensitive matching then routes "adminKey" (or "ADMINKEY") to the setter.
+     *
+     * Security assertion: adminKey must NOT be settable via JSON when the enclosing
+     * container declares @JsonIgnoreProperties("adminKey") on the field.
+     */
+    @Test
+    public void test5962_caseInsensitiveRebuildRestoresIgnoredProperty() throws Exception {
+        ObjectMapper mapper = jsonMapperBuilder().build();
+
+        // Exact case — should be blocked by @JsonIgnoreProperties
+        String json = "{\"admin\":{\"adminKey\":\"HACKED\",\"username\":\"alice\"}}";
+        Container result = mapper.readValue(json, Container.class);
+        assertNotEquals("HACKED", result.admin.adminKey,
+                "[databind#5962]: case-insensitive BeanPropertyMap rebuild restored 'adminKey' " +
+                "after it was removed by @JsonIgnoreProperties. The property was set to 'HACKED'.");
+        assertEquals("alice", result.admin.username);
+
+        // Mixed case — exploits the case-insensitive rebuild more directly
+        String jsonMixed = "{\"admin\":{\"AdminKey\":\"HACKED2\",\"username\":\"bob\"}}";
+        Container result2 = mapper.readValue(jsonMixed, Container.class);
+        assertNotEquals("HACKED2", result2.admin.adminKey,
+                "[databind#5962]: 'AdminKey' (mixed case) matched 'adminKey' via case-insensitive " +
+                "lookup that was rebuilt from the unfiltered property map.");
+    }
+}