Fix #5962: Case-insensitive deserialization may use wrong @JsonIgnoreProperties - #5964
Merged
cowtowncoder merged 1 commit intoMay 6, 2026
Merged
Conversation
🧪 Code Coverage Report
|
cowtowncoder
deleted the
tatu-claude/3.1/5962-bean-deser-base-ci-ignore-props
branch
May 6, 2026 01:39
bentmann
reviewed
Jun 17, 2026
| * container declares @JsonIgnoreProperties("adminKey") on the field. | ||
| */ | ||
| @Test | ||
| public void test5962_caseInsensitiveRebuildRestoresIgnoredProperty() throws Exception { |
There was a problem hiding this comment.
I'm confused by GHSA-5jmj-h7xm-6q6v, this test fails for me with Jackson 2.21.4, suggesting that version is also affected, yet the advisory says only >= 3.1.0, < 3.1.4 is affected. What am I missing here?
Member
Author
There was a problem hiding this comment.
The issue was specifically reported against 3.1 -- unlike other problems that included 2.21 (and often 2.18). I assumed reported had analyzed these cases; perhaps they did not?
If test can be made to fail against 2.21 branch (or maybe even 2.18), I'd be happy to address there too. Note: PR against 2.18 is likely forward mergeable to 2.21 so one pr would be fine.
There was a problem hiding this comment.
Sonatype now flags it: #5962 (comment)
pjfanning
added a commit
to pjfanning/jackson-databind
that referenced
this pull request
Jun 18, 2026
cowtowncoder
pushed a commit
that referenced
this pull request
Jun 18, 2026
jkschneider
pushed a commit
to moderne-backpatch-alliance/backpatch-jackson-databind
that referenced
this pull request
Sep 16, 2026
…er case-insensitive matching Port of upstream bc1613c ("Backport PR FasterXML#5964 into 2.18 to fix FasterXML#5962", FasterXML#6039), shipped in 2.18.9, onto the 2.13.5 baseline. BeanDeserializerBase.createContextual() first calls _handleByNameInclusion() to apply the per-property @JsonIgnoreProperties exclusions, producing a contextual deserializer whose BeanPropertyMap no longer carries the ignored properties. If the property ALSO carries @jsonformat(with = Feature.ACCEPT_CASE_INSENSITIVE_PROPERTIES), the block that follows rebuilt the case-insensitive map from `_beanProperties` -- this deserializer's ORIGINAL, unfiltered map -- and then installed it on the contextual one. Every property the exclusion had just removed came back, and case-insensitive lookup then routed the incoming field to it. A declared @JsonIgnoreProperties("adminKey") stopped holding, which is a write to a field the application had declared off-limits to JSON. The fix reads contextual._beanProperties instead, so the rebuild starts from the filtered map. NOT A CHERRY-PICK: the commit also edits release-notes/VERSION-2.x and CREDITS-2.x, which have no 2.18 section at this baseline and conflict. The production hunk merged with no conflict and is upstream's bytes -- one changed line plus upstream's three-line comment. Binary compatibility: no API change of any kind; one expression inside an existing method body. BEHAVIOUR CHANGE: a property excluded by a per-property @JsonIgnoreProperties stays excluded when case-insensitive matching is enabled on the same property. A consumer that (knowingly or not) depended on the property being writable again will now see it ignored -- which is the CVE. Regression gate: IgnorePropertiesCaseInsensitive5962Test, upstream's own file for the issue, converted from JUnit 5 on DatabindTestUtil (neither exists at this baseline) to JUnit 3 on BaseMapTest: @test dropped, methods renamed to the testXxx form, and assertNotEquals rewritten in JUnit 4's (message, unexpected, actual) argument order. The DTOs, payloads and asserted values are upstream's, including its own negative control -- the same document against a container WITHOUT the case-insensitive format override, which passes on the unpatched baseline and is what shows the exclusion mechanism itself was never broken. Upstream-Commit: bc1613c
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
No description provided.