backpatch CVE-2026-54515: keep per-property @JsonIgnoreProperties under case-insensitive matching

Port of upstream bc1613c ("Backport PR FasterXML#5964
into 2.18 to fix FasterXML#5962", FasterXML#6039), shipped in 2.18.9, onto the 2.13.5 baseline.

BeanDeserializerBase.createContextual() first calls _handleByNameInclusion() to
apply the per-property @JsonIgnoreProperties exclusions, producing a contextual
deserializer whose BeanPropertyMap no longer carries the ignored properties. If
the property ALSO carries @jsonformat(with =
Feature.ACCEPT_CASE_INSENSITIVE_PROPERTIES), the block that follows rebuilt the
case-insensitive map from `_beanProperties` -- this deserializer's ORIGINAL,
unfiltered map -- and then installed it on the contextual one. Every property
the exclusion had just removed came back, and case-insensitive lookup then
routed the incoming field to it. A declared @JsonIgnoreProperties("adminKey")
stopped holding, which is a write to a field the application had declared
off-limits to JSON.

The fix reads contextual._beanProperties instead, so the rebuild starts from
the filtered map.

NOT A CHERRY-PICK: the commit also edits release-notes/VERSION-2.x and
CREDITS-2.x, which have no 2.18 section at this baseline and conflict. The
production hunk merged with no conflict and is upstream's bytes -- one changed
line plus upstream's three-line comment.

Binary compatibility: no API change of any kind; one expression inside an
existing method body.

BEHAVIOUR CHANGE: a property excluded by a per-property @JsonIgnoreProperties
stays excluded when case-insensitive matching is enabled on the same property.
A consumer that (knowingly or not) depended on the property being writable
again will now see it ignored -- which is the CVE.

Regression gate: IgnorePropertiesCaseInsensitive5962Test, upstream's own file
for the issue, converted from JUnit 5 on DatabindTestUtil (neither exists at
this baseline) to JUnit 3 on BaseMapTest: @test dropped, methods renamed to the
testXxx form, and assertNotEquals rewritten in JUnit 4's
(message, unexpected, actual) argument order. The DTOs, payloads and asserted
values are upstream's, including its own negative control -- the same document
against a container WITHOUT the case-insensitive format override, which passes
on the unpatched baseline and is what shows the exclusion mechanism itself was
never broken.

Upstream-Commit: bc1613c

Author: pstreef

src/main/java/com/fasterxml/jackson/databind/deser/BeanDeserializerBase.java

@@ -808,7 +808,10 @@ public JsonDeserializer<?> createContextual(DeserializationContext ctxt,
             // 16-May-2016, tatu: How about per-property case-insensitivity?
             Boolean B = format.getFeature(JsonFormat.Feature.ACCEPT_CASE_INSENSITIVE_PROPERTIES);
             if (B != null) {
-                BeanPropertyMap propsOrig = _beanProperties;
+                // [databind#5962]: must rebuild from the (possibly filtered) contextual
+                // BeanPropertyMap so that per-property @JsonIgnoreProperties exclusions
+                // applied by _handleByNameInclusion() above are preserved.
+                BeanPropertyMap propsOrig = contextual._beanProperties;
                 BeanPropertyMap props = propsOrig.withCaseInsensitivity(B.booleanValue());
                 if (props != propsOrig) {
                     contextual = contextual.withBeanProperties(props);

src/test/java/com/fasterxml/jackson/databind/deser/filter/IgnorePropertiesCaseInsensitive5962Test.java

@@ -0,0 +1,89 @@
+package com.fasterxml.jackson.databind.deser.filter;
+
+import com.fasterxml.jackson.annotation.JsonFormat;
+import com.fasterxml.jackson.annotation.JsonIgnoreProperties;
+
+import com.fasterxml.jackson.databind.*;
+
+import static org.junit.Assert.assertNotEquals;
+
+/**
+ * [databind#5962]: Case-insensitive BeanPropertyMap rebuild undoes per-property
+ * {@code @JsonIgnoreProperties}.
+ *
+ * {@code BeanDeserializerBase.createContextual()} calls {@code _handleByNameInclusion()}
+ * to filter properties according to per-property {@code @JsonIgnoreProperties}, producing
+ * a contextual deserializer with the restricted {@code BeanPropertyMap}. However, the
+ * subsequent case-insensitivity block read {@code _beanProperties} (the *original*
+ * unfiltered map from {@code this}) rather than {@code contextual._beanProperties} (the
+ * filtered map). {@code withCaseInsensitivity()} then rebuilt the map from the unfiltered
+ * source, and {@code contextual.withBeanProperties(props)} overwrote the filtered map with
+ * the unfiltered one — any properties removed by {@code _handleByNameInclusion} were
+ * restored.
+ *
+ * Patch: source the case-insensitive rebuild from {@code contextual._beanProperties}.
+ */
+public class IgnorePropertiesCaseInsensitive5962Test extends BaseMapTest
+{
+    static class AdminDto {
+        public String adminKey = "DEFAULT";
+        public String username;
+    }
+
+    // Container that ignores "adminKey" on the AdminDto field AND enables case-insensitive matching
+    static class Container {
+        @JsonIgnoreProperties("adminKey")
+        @JsonFormat(with = JsonFormat.Feature.ACCEPT_CASE_INSENSITIVE_PROPERTIES)
+        public AdminDto admin;
+    }
+
+    // Baseline container: only @JsonIgnoreProperties, no case-insensitive format override
+    static class BaselineContainer {
+        @JsonIgnoreProperties("adminKey")
+        public AdminDto admin;
+    }
+
+    /**
+     * NEGATIVE CONTROL: without the @JsonFormat case-insensitive override, @JsonIgnoreProperties
+     * correctly suppresses adminKey on the nested AdminDto field.
+     */
+    public void testNegativeControlWithoutCaseInsensitivity() throws Exception {
+        ObjectMapper mapper = jsonMapperBuilder().build();
+        String json = "{\"admin\":{\"adminKey\":\"HACKED\",\"username\":\"alice\"}}";
+        BaselineContainer result = mapper.readValue(json, BaselineContainer.class);
+        // Without case-insensitive format, @JsonIgnoreProperties blocks adminKey
+        assertNotEquals("@JsonIgnoreProperties alone (no case-insensitive format) should block adminKey",
+                "HACKED", result.admin.adminKey);
+        assertEquals("alice", result.admin.username);
+    }
+
+    /**
+     * EXPLOIT PATH: the case-insensitive BeanPropertyMap rebuild (triggered by
+     * @JsonFormat ACCEPT_CASE_INSENSITIVE_PROPERTIES) restores the unfiltered original
+     * _beanProperties, undoing the @JsonIgnoreProperties("adminKey") exclusion.
+     * Case-insensitive matching then routes "adminKey" (or "ADMINKEY") to the setter.
+     *
+     * Security assertion: adminKey must NOT be settable via JSON when the enclosing
+     * container declares @JsonIgnoreProperties("adminKey") on the field.
+     */
+    public void testCaseInsensitiveRebuildRestoresIgnoredProperty() throws Exception {
+        ObjectMapper mapper = jsonMapperBuilder()
+                .disable(DeserializationFeature.FAIL_ON_UNKNOWN_PROPERTIES)
+                .build();
+
+        // Exact case — should be blocked by @JsonIgnoreProperties
+        String json = "{\"admin\":{\"adminKey\":\"HACKED\",\"username\":\"alice\"}}";
+        Container result = mapper.readValue(json, Container.class);
+        assertNotEquals("[databind#5962]: case-insensitive BeanPropertyMap rebuild restored 'adminKey' " +
+                        "after it was removed by @JsonIgnoreProperties. The property was set to 'HACKED'.",
+                "HACKED", result.admin.adminKey);
+        assertEquals("alice", result.admin.username);
+
+        // Mixed case — exploits the case-insensitive rebuild more directly
+        String jsonMixed = "{\"admin\":{\"AdminKey\":\"HACKED2\",\"username\":\"bob\"}}";
+        Container result2 = mapper.readValue(jsonMixed, Container.class);
+        assertNotEquals("[databind#5962]: 'AdminKey' (mixed case) matched 'adminKey' via case-insensitive " +
+                        "lookup that was rebuilt from the unfiltered property map.",
+                "HACKED2", result2.admin.adminKey);
+    }
+}