Skip to content

Backport PR #5964 into 2.18 to fix #5962 - #6039

Merged
cowtowncoder merged 4 commits into
FasterXML:2.18from
pjfanning:issue2.18
Jun 18, 2026
Merged

Backport PR #5964 into 2.18 to fix #5962#6039
cowtowncoder merged 4 commits into
FasterXML:2.18from
pjfanning:issue2.18

Conversation

@pjfanning

@pjfanning pjfanning commented Jun 18, 2026 •
edited
Loading

Copy link
Copy Markdown
Member

backports test from 3.x branch.
#5964 #5962

One of the tests is broken:

[ERROR] Tests run: 2, Failures: 1, Errors: 0, Skipped: 0, Time elapsed: 0.014 s <<< FAILURE! -- in com.fasterxml.jackson.databind.deser.filter.IgnorePropertiesCaseInsensitive5962Test
[ERROR] com.fasterxml.jackson.databind.deser.filter.IgnorePropertiesCaseInsensitive5962Test.test5962_caseInsensitiveRebuildRestoresIgnoredProperty -- Time elapsed: 0.007 s <<< FAILURE!
org.opentest4j.AssertionFailedError: [databind#5962]: case-insensitive BeanPropertyMap rebuild restored 'adminKey' after it was removed by @JsonIgnoreProperties. The property was set to 'HACKED'. ==> expected: not equal but was: <HACKED>
	at org.junit.jupiter.api.AssertionFailureBuilder.build(AssertionFailureBuilder.java:152)
	at org.junit.jupiter.api.AssertionFailureBuilder.buildAndThrow(AssertionFailureBuilder.java:132)
	at org.junit.jupiter.api.AssertNotEquals.failEqual(AssertNotEquals.java:277)
	at org.junit.jupiter.api.AssertNotEquals.assertNotEquals(AssertNotEquals.java:263)
	at org.junit.jupiter.api.Assertions.assertNotEquals(Assertions.java:2832)
	at com.fasterxml.jackson.databind.deser.filter.IgnorePropertiesCaseInsensitive5962Test.test5962_caseInsensitiveRebuildRestoresIgnoredProperty(IgnorePropertiesCaseInsensitive5962Test.java:80)

I applied the fix from #5964 but it didn't fix the issue in the 2.18 code base.
The test fails in a different way with the 3.1 fix.

[ERROR] Errors: 
[ERROR]   IgnorePropertiesCaseInsensitive5962Test.test5962_caseInsensitiveRebuildRestoresIgnoredProperty:87 » UnrecognizedProperty Unrecognized field "AdminKey" (class com.fasterxml.jackson.databind.deser.filter.IgnorePropertiesCaseInsensitive5962Test$AdminDto), not marked as ignorable (one known property: "username"])
 at [Source: (String)"{"admin":{"AdminKey":"HACKED2","username":"bob"}}"; line: 1, column: 23] (through reference chain: com.fasterxml.jackson.databind.deser.filter.IgnorePropertiesCaseInsensitive5962Test$Container["admin"]->com.fasterxml.jackson.databind.deser.filter.IgnorePropertiesCaseInsensitive5962Test$AdminDto["AdminKey"])

@pjfanning
pjfanning changed the base branch from 3.x to 2.18 June 18, 2026 09:41
@pjfanning pjfanning mentioned this pull request Jun 18, 2026
Closed
1 task
@cowtowncoder

cowtowncoder commented Jun 18, 2026

Copy link
Copy Markdown
Member

@pjfanning Failure could be due to different defaults for DeserializationFeature.FAIL_ON_UNKNOWN_PROPERTIES?

@pjfanning

pjfanning commented Jun 18, 2026

Copy link
Copy Markdown
Member Author

@cowtowncoder FAIL_ON_UNKNOWN_PROPERTIES was the reason the test failed after the change.

Is this ok to merge as is or do we need to come up with a fix that works when FAIL_ON_UNKNOWN_PROPERTIES is enabled?

@cowtowncoder

cowtowncoder commented Jun 18, 2026

Copy link
Copy Markdown
Member

@pjfanning I think this is sufficient -- as long as by-pass can no longer occur, exact exception (esp. in case of 2.x) does not seem that important?

@cowtowncoder

cowtowncoder commented Jun 18, 2026 •
edited
Loading

Copy link
Copy Markdown
Member

Just need to add release notes entry (copy from 3.1.4 to 2.18.9 section) and I can merge this PR, merge forward, update wikis.

EDIT: added release notes, will merge.

@cowtowncoder cowtowncoder changed the title Create IgnorePropertiesCaseInsensitive5962Test.java Backport #5962 fix into 2.18 Jun 18, 2026
@cowtowncoder cowtowncoder changed the title Backport #5962 fix into 2.18 Backport PR #5964 into 2.18 to fix #5962 Jun 18, 2026
@cowtowncoder cowtowncoder added the 2.18 Issues planned at 2.18 or later label Jun 18, 2026
@cowtowncoder cowtowncoder added this to the 2.18.9 milestone Jun 18, 2026
@cowtowncoder cowtowncoder mentioned this pull request Jun 18, 2026
Closed
@cowtowncoder
cowtowncoder merged commit bc1613c into FasterXML:2.18 Jun 18, 2026
5 of 6 checks passed
@cowtowncoder

cowtowncoder commented Jun 18, 2026

Copy link
Copy Markdown
Member

Thank you @pjfanning !

@pjfanning
pjfanning deleted the issue2.18 branch June 18, 2026 16:01
@devin-ai-integration devin-ai-integration Bot mentioned this pull request Jun 24, 2026
Merged
3 tasks
jkschneider pushed a commit to moderne-backpatch-alliance/backpatch-jackson-databind that referenced this pull request Sep 16, 2026
@pstreef @jkschneider
backpatch CVE-2026-54515: keep per-property @JsonIgnoreProperties und…
c64d3c8 
…er case-insensitive matching

Port of upstream bc1613c ("Backport PR FasterXML#5964
into 2.18 to fix FasterXML#5962", FasterXML#6039), shipped in 2.18.9, onto the 2.13.5 baseline.

BeanDeserializerBase.createContextual() first calls _handleByNameInclusion() to
apply the per-property @JsonIgnoreProperties exclusions, producing a contextual
deserializer whose BeanPropertyMap no longer carries the ignored properties. If
the property ALSO carries @jsonformat(with =
Feature.ACCEPT_CASE_INSENSITIVE_PROPERTIES), the block that follows rebuilt the
case-insensitive map from `_beanProperties` -- this deserializer's ORIGINAL,
unfiltered map -- and then installed it on the contextual one. Every property
the exclusion had just removed came back, and case-insensitive lookup then
routed the incoming field to it. A declared @JsonIgnoreProperties("adminKey")
stopped holding, which is a write to a field the application had declared
off-limits to JSON.

The fix reads contextual._beanProperties instead, so the rebuild starts from
the filtered map.

NOT A CHERRY-PICK: the commit also edits release-notes/VERSION-2.x and
CREDITS-2.x, which have no 2.18 section at this baseline and conflict. The
production hunk merged with no conflict and is upstream's bytes -- one changed
line plus upstream's three-line comment.

Binary compatibility: no API change of any kind; one expression inside an
existing method body.

BEHAVIOUR CHANGE: a property excluded by a per-property @JsonIgnoreProperties
stays excluded when case-insensitive matching is enabled on the same property.
A consumer that (knowingly or not) depended on the property being writable
again will now see it ignored -- which is the CVE.

Regression gate: IgnorePropertiesCaseInsensitive5962Test, upstream's own file
for the issue, converted from JUnit 5 on DatabindTestUtil (neither exists at
this baseline) to JUnit 3 on BaseMapTest: @test dropped, methods renamed to the
testXxx form, and assertNotEquals rewritten in JUnit 4's
(message, unexpected, actual) argument order. The DTOs, payloads and asserted
values are upstream's, including its own negative control -- the same document
against a container WITHOUT the case-insensitive format override, which passes
on the unpatched baseline and is what shows the exclusion mechanism itself was
never broken.

Upstream-Commit: bc1613c
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

2.18 Issues planned at 2.18 or later

Projects

None yet

Milestone

2.18.9

Development

Successfully merging this pull request may close these issues.

2 participants

@pjfanning @cowtowncoder