INT-4342: White List for Payload Deserializer

JIRA: https://jira.spring.io/browse/INT-4342

Use similar code to Spring AMQP to add white list support for Integration's
use of the `DeserializingMessageConverter`; introduce the `WhiteListDeserializingMessageConverter`.

Polishing

Missed this change in PR.

Fix XSD attribute

spring-integration-core/src/test/java/org/springframework/integration/config/xml/PayloadDeserializingTransformerParserTests-context.xml

@@ -19,14 +19,17 @@
 		<queue capacity="1"/>
 	</channel>
 
-	<payload-deserializing-transformer input-channel="directInput" output-channel="output"/>
+	<payload-deserializing-transformer id="direct" input-channel="directInput" output-channel="output"
+		white-list="*" />
 
 	<payload-deserializing-transformer input-channel="queueInput" output-channel="output">
 		<poller fixed-delay="10000"/>
 	</payload-deserializing-transformer>
 
-	<payload-deserializing-transformer input-channel="customDeserializerInput" output-channel="output" deserializer="customDeserializer"/>
+	<payload-deserializing-transformer input-channel="customDeserializerInput" output-channel="output"
+		deserializer="customDeserializer"/>
 
-	<beans:bean id="customDeserializer" class="org.springframework.integration.config.xml.PayloadDeserializingTransformerParserTests$TestDeserializer"/>
+	<beans:bean id="customDeserializer"
+		class="org.springframework.integration.config.xml.PayloadDeserializingTransformerParserTests$TestDeserializer"/>
 
 </beans:beans>

spring-integration-core/src/test/java/org/springframework/integration/config/xml/PayloadDeserializingTransformerParserTests.java

@@ -16,8 +16,10 @@
 
 package org.springframework.integration.config.xml;
 
+import static org.hamcrest.Matchers.equalTo;
 import static org.junit.Assert.assertEquals;
 import static org.junit.Assert.assertNotNull;
+import static org.junit.Assert.assertThat;
 import static org.junit.Assert.assertTrue;
 
 import java.io.ByteArrayOutputStream;
@@ -26,15 +28,19 @@ import java.io.InputStream;
 import java.io.InputStreamReader;
 import java.io.ObjectOutputStream;
 import java.io.Serializable;
+import java.util.Set;
 
 import org.junit.Test;
 import org.junit.runner.RunWith;
 
 import org.springframework.beans.factory.annotation.Autowired;
+import org.springframework.beans.factory.annotation.Qualifier;
 import org.springframework.core.serializer.Deserializer;
+import org.springframework.integration.test.util.TestUtils;
 import org.springframework.integration.transformer.MessageTransformationException;
 import org.springframework.messaging.Message;
 import org.springframework.messaging.MessageChannel;
+import org.springframework.messaging.MessageHandler;
 import org.springframework.messaging.PollableChannel;
 import org.springframework.messaging.support.GenericMessage;
 import org.springframework.test.context.ContextConfiguration;
@@ -60,6 +66,10 @@ public class PayloadDeserializingTransformerParserTests {
 	@Autowired
 	private PollableChannel output;
 
+	@Autowired
+	@Qualifier("direct.handler")
+	private MessageHandler handler;
+
 
 	@Test
 	public void directChannelWithSerializedStringMessage() throws Exception {
@@ -69,6 +79,10 @@ public class PayloadDeserializingTransformerParserTests {
 		assertNotNull(result);
 		assertTrue(result.getPayload() instanceof String);
 		assertEquals("foo", result.getPayload());
+		Set<?> patterns = TestUtils.getPropertyValue(this.handler, "transformer.converter.whiteListPatterns",
+				Set.class);
+		assertThat(patterns.size(), equalTo(1));
+		assertThat(patterns.iterator().next(), equalTo("*"));
 	}
 
 	@Test

spring-integration-core/src/test/java/org/springframework/integration/dsl/flows/IntegrationFlowTests.java

@@ -26,6 +26,7 @@ import static org.junit.Assert.assertThat;
 import static org.junit.Assert.assertTrue;
 import static org.junit.Assert.fail;
 
+import java.io.Serializable;
 import java.util.concurrent.CountDownLatch;
 import java.util.concurrent.Executors;
 import java.util.concurrent.TimeUnit;
@@ -61,6 +62,7 @@ import org.springframework.integration.context.IntegrationContextUtils;
 import org.springframework.integration.dsl.IntegrationFlow;
 import org.springframework.integration.dsl.IntegrationFlows;
 import org.springframework.integration.dsl.Pollers;
+import org.springframework.integration.dsl.Transformers;
 import org.springframework.integration.dsl.channel.MessageChannels;
 import org.springframework.integration.handler.AbstractReplyProducingMessageHandler;
 import org.springframework.integration.handler.GenericHandler;
@@ -72,7 +74,6 @@ import org.springframework.integration.store.MessageStore;
 import org.springframework.integration.store.SimpleMessageStore;
 import org.springframework.integration.support.MessageBuilder;
 import org.springframework.integration.support.MutableMessageBuilder;
-import org.springframework.integration.transformer.PayloadDeserializingTransformer;
 import org.springframework.integration.transformer.PayloadSerializingTransformer;
 import org.springframework.messaging.Message;
 import org.springframework.messaging.MessageChannel;
@@ -592,10 +593,12 @@ public class IntegrationFlowTests {
 					.channel("foo")
 					.fixedSubscriberChannel()
 					.<String, Integer>transform(Integer::parseInt)
+					.<Integer, Foo>transform(i -> new Foo(i))
 					.transform(new PayloadSerializingTransformer(),
 							c -> c.autoStartup(false).id("payloadSerializingTransformer"))
 					.channel(MessageChannels.queue(new SimpleMessageStore(), "fooQueue"))
-					.transform(new PayloadDeserializingTransformer())
+					.transform(Transformers.deserializer(Foo.class.getName()))
+					.<Foo, Integer>transform(f -> f.value)
 					.filter("true", e -> e.id("expressionFilter"))
 					.channel(publishSubscribeChannel())
 					.transform((Integer p) -> p * 2, c -> c.advice(this.expressionAdvice()))
@@ -863,5 +866,16 @@ public class IntegrationFlowTests {
 
 	}
 
+	@SuppressWarnings("serial")
+	public static class Foo implements Serializable {
+
+		private final Integer value;
+
+		public Foo(Integer value) {
+			this.value = value;
+		}
+
+	}
+
 }
 

spring-integration-core/src/test/java/org/springframework/integration/transformer/PayloadDeserializingTransformerTests.java

@@ -16,8 +16,12 @@
 
 package org.springframework.integration.transformer;
 
+import static org.hamcrest.Matchers.instanceOf;
+import static org.hamcrest.Matchers.startsWith;
 import static org.junit.Assert.assertEquals;
 import static org.junit.Assert.assertNotNull;
+import static org.junit.Assert.assertThat;
+import static org.junit.Assert.fail;
 
 import java.io.ByteArrayOutputStream;
 import java.io.ObjectOutputStream;
@@ -63,6 +67,31 @@ public class PayloadDeserializingTransformerTests {
 		assertEquals(testBean.name, ((TestBean) payload).name);
 	}
 
+	@Test
+	public void deserializeObjectWhiteList() throws Exception {
+		TestBean testBean = new TestBean("test");
+		ByteArrayOutputStream byteStream = new ByteArrayOutputStream();
+		ObjectOutputStream objectStream = new ObjectOutputStream(byteStream);
+		objectStream.writeObject(testBean);
+		byte[] serialized = byteStream.toByteArray();
+		PayloadDeserializingTransformer transformer = new PayloadDeserializingTransformer();
+		transformer.setWhiteListPatterns("com.*");
+		try {
+			transformer.transform(new GenericMessage<byte[]>(serialized));
+			fail("expected security exception");
+		}
+		catch (MessageTransformationException e) {
+			assertThat(e.getCause().getCause(), instanceOf(SecurityException.class));
+			assertThat(e.getCause().getCause().getMessage(), startsWith("Attempt to deserialize unauthorized"));
+		}
+		transformer.setWhiteListPatterns("org.*");
+		Message<?> result = transformer.transform(new GenericMessage<byte[]>(serialized));
+		Object payload = result.getPayload();
+		assertNotNull(payload);
+		assertEquals(TestBean.class, payload.getClass());
+		assertEquals(testBean.name, ((TestBean) payload).name);
+	}
+
 	@Test(expected = MessageTransformationException.class)
 	public void invalidPayload() {
 		byte[] bytes = new byte[] { 1, 2, 3 };